Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT. Which Security policy rule will allow traffic to flow to the web server?

The correct answer is D. Untrust (any) to DMZ (1.1.1.100), web browsing -Allow. When Destination NAT (DNAT) is configured on a Palo Alto Networks firewall, Security policy evaluation uses the pre-NAT destination IP address but the post-NAT destination zone. Traffic arrives from the Untrust zone destined for the public IP 1.1.1.100; the firewall's route…

Submitted by yousef_jo· Apr 18, 2026Securing Traffic

Question

Exhibit

Options

AUntrust (any) to DMZ (10.1.1.100), web browsing -Allow
BUntrust (any) to Untrust (1.1.1.100), web browsing -Allow
CUntrust (any) to Untrust (10.1.1.100), web browsing -Allow
DUntrust (any) to DMZ (1.1.1.100), web browsing -Allow

How the community answered

(24 responses)

A
17% (4)
B
4% (1)
C
4% (1)
D
75% (18)

Explanation

When Destination NAT (DNAT) is configured on a Palo Alto Networks firewall, Security policy evaluation uses the pre-NAT destination IP address but the post-NAT destination zone. Traffic arrives from the Untrust zone destined for the public IP 1.1.1.100; the firewall's route lookup for the translated address (10.1.1.100) determines the egress zone is DMZ. Therefore the Security policy rule must specify: source zone = Untrust, destination zone = DMZ (post-NAT zone), and destination address = 1.1.1.100 (pre-NAT public IP). Option D is the only choice that correctly pairs the DMZ zone with the pre-NAT public IP.

Topics

#DNAT#Security Policy#Policy Matching#Firewall Rules

Community Discussion

No community discussion yet for this question.

Full PCNSA Practice