An administrator has deployed an AWS transit gateway and used multiple VPC spokes to segregate a multi-tier application. The administrator also created a security VPC with multiple VM-Series NGFWs…

Question

Options

• Asource address translation
• Bdestination address translation
• Cport address translation
• Dsource and destination address translation

• A
  67% (14)
• B
  19% (4)
• C
  10% (2)
• D
  5% (1)

Explanation

Source NAT (SNAT) is correct because in an active/active NGFW deployment with ECMP, outbound packets may exit through Firewall A while return packets could arrive at Firewall B - and since stateful firewalls only track sessions they initiated, Firewall B will drop traffic it has no session state for. By applying SNAT on the egress interface, the firewall substitutes its own IP as the source address, forcing return traffic to route back to that same firewall (since the destination is now the firewall's own IP), preserving session symmetry.

Why the distractors fail:

• B (DNAT) translates destination addresses - useful for redirecting inbound traffic to internal servers, but does nothing to anchor return traffic to the originating firewall.
• C (PAT) is port-level overloading, a subtype of source NAT - while technically related, PAT alone isn't the specific mechanism that resolves the asymmetric path problem in ECMP scenarios; the exam targets the broader SNAT concept.
• D (Source + Destination NAT) is overkill - only source translation is needed to pin return traffic; adding DNAT here introduces unnecessary complexity and doesn't solve the problem any better.

Memory tip: Think "SNAT = Return Ticket Home." When a firewall SNATs traffic, it stamps its own IP on the packet - so the return journey is always addressed back to that firewall, keeping the session on one stateful path.

No community discussion yet for this question.