Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Palo Alto Networks Certified Network Security Engineer (PCNSE) · Palo Alto Networks
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Answer: D Because Internet interface doesn't need to define. Only we need to define DMZ interface IP address (Where traffic is actually destined to)
In this scenario, Destination NAT (DNAT) is used to map the public IP address 1.1.1.100 (which is in the Untrust zone) to the private IP address 10.1.1.100 (which is in the DMZ zone). This allows external traffic destined for 1.1.1.100 to be forwarded to the web server at 10.1.1.100. To allow traffic to flow correctly, the security policy must allow the traffic to enter the DMZ zone using the 1.1.1.100 address, as the NAT process will map this public IP to the internal server.
D is the correct answer. the question is about security policy and the destination is 10.1.1.100