nerdexam
Palo_Alto_Networks

PCNSE · Question #736

A firewall engineer creates a NAT rule to translate IP address 1.1.1.10 to 192.168.1.10. The engineer also plans to enable DNS rewrite so that the firewall rewrites the IPv4 address in a DNS…

The correct answer is A. Enable DNS rewrite under the destination address translation in the Translated Packet section of. To enable DNS rewrite for a Destination NAT rule, the "DNS Rewrite" option must be explicitly enabled within the Translated Packet tab of that specific NAT rule.

Submitted by femi9· Apr 18, 2026Deploy and Configure

Question

A firewall engineer creates a NAT rule to translate IP address 1.1.1.10 to 192.168.1.10. The engineer also plans to enable DNS rewrite so that the firewall rewrites the IPv4 address in a DNS response based on the original destination IP address and translated destination IP address configured for the rule. The engineer wants the firewall to rewrite a DNS response of 1.1.1.10 to 192.168.1.10. What should the engineer do to complete the configuration?

Options

  • AEnable DNS rewrite under the destination address translation in the Translated Packet section of
  • BCreate a U-Turn NAT to translate the destination IP address 1.1.1.10 to 192.168.1.10 with the
  • CEnable DNS rewrite under the destination address translation in the Translated Packet section of
  • DCreate a U-Turn NAT to translate the destination IP address 192.168.1.10 to 1.1.1.10 with the

How the community answered

(40 responses)
  • A
    70% (28)
  • B
    5% (2)
  • C
    18% (7)
  • D
    8% (3)

Why each option

To enable DNS rewrite for a Destination NAT rule, the "DNS Rewrite" option must be explicitly enabled within the Translated Packet tab of that specific NAT rule.

AEnable DNS rewrite under the destination address translation in the Translated Packet section ofCorrect

The DNS rewrite feature is configured directly within the Destination NAT rule, under the "Translated Packet" tab. Enabling this option instructs the firewall to automatically rewrite A records in DNS responses, changing the original public IP (1.1.1.10) to the translated private IP (192.168.1.10) for internal clients.

BCreate a U-Turn NAT to translate the destination IP address 1.1.1.10 to 192.168.1.10 with the

Creating a U-Turn NAT is for internal clients accessing internal servers via their public IP, which is a different scenario from enabling DNS rewrite within an existing DNAT rule.

CEnable DNS rewrite under the destination address translation in the Translated Packet section of

This option is a partial and less precise description compared to option A, which fully describes the correct configuration step and location.

DCreate a U-Turn NAT to translate the destination IP address 192.168.1.10 to 1.1.1.10 with the

Creating a U-Turn NAT with the destination IP 192.168.1.10 to 1.1.1.10 would be for a reverse scenario or internal access, not directly for enabling DNS rewrite on an existing DNAT.

Concept tested: Destination NAT with DNS Rewrite

Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/nat/nat-configuration-examples/dnat-with-dns-rewrite.html

Topics

#NAT#DNS Rewrite#Palo Alto Firewall#Configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCNSE Practice