PCNSA · Question #182
What does an administrator use to validate whether a session is matching an expected NAT policy?
The correct answer is B. test command. Palo Alto Networks provides CLI 'test' commands that simulate policy lookups without requiring live traffic. The command 'test nat-policy-match' allows an administrator to specify source/destination IP, zone, protocol, and port, and the firewall returns which NAT policy rule…
Question
What does an administrator use to validate whether a session is matching an expected NAT policy?
Options
- Asystem log
- Btest command
- Cthreat log
- Dconfig audit
How the community answered
(32 responses)- A6% (2)
- B88% (28)
- C3% (1)
- D3% (1)
Explanation
Palo Alto Networks provides CLI 'test' commands that simulate policy lookups without requiring live traffic. The command 'test nat-policy-match' allows an administrator to specify source/destination IP, zone, protocol, and port, and the firewall returns which NAT policy rule - if any - would match. This is the correct tool for validating NAT policy behavior before or after changes. System logs (A) and threat logs (C) record events from actual traffic and would not help proactively validate expected behavior. Config audit (D) compares configuration versions but does not perform policy match simulations.
Topics
Community Discussion
No community discussion yet for this question.