An internal host wants to connect to servers of the internet through using source NAT. Which policy is required to enable source NAT on the firewall?

A NAT policy requires specifying both the source zone (where the internal host resides) and the destination zone (where the internet servers reside, typically the 'Untrust' or 'Outside' zone) to correctly apply source NAT for outbound connections. This definition tells the firewall which traffic flow needs the NAT transformation.

"post-NAT policy with external source and any destination address" is incorrect because a source NAT policy defines the *pre-NAT* source (internal) and the *post-NAT* source (external IP of firewall), and policies typically refer to pre-NAT attributes for matching.

A NAT policy *must* have source and destination zones defined to determine which traffic flow the NAT rule applies to; without them, the policy is not specific enough to function correctly.

"pre-NAT policy with external source and any destination address" is incorrect because the pre-NAT source for an internal host going to the internet is *internal*, not external.