Which two matching criteria are used when creating a Security policy involving NAT? (Choose two.)

Security policies are evaluated on the original (Pre-NAT) source IP address, as this represents the true identity of the initiator before any address translation occurs.

Security policies are not matched on the post-NAT address, whether source or destination, because the policy engine needs to make decisions based on the packet's original source and its intended logical destination zone after translation.

Security policies use the source zone based on the original ingress interface, but for destination-based NAT, the destination zone is evaluated based on where the packet is intended to go *after* NAT, which is the post-NAT zone, not a pre-NAT zone.

For destination NAT (DNAT), the security policy applies to the post-NAT destination zone because the packet is routed to that zone after its destination IP address is translated.