JNCIA-SEC Network Address Translation Practice Test 2 — 15 Questions

Question 1

You are auditing a Junos security device configuration. You observe multiple Static NAT rules configured across different rule sets. One of the rules uses the 'off-path' or similar specialized handling? Wait, you recall Junos Static NAT rule configuration details. Which statement correctly describes how Junos Static NAT handles bi-directional traffic flow without requiring separate source NAT rules?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Static NAT automatically provides bidirectional translation, handling both inbound destination translation and outbound source translation implicitly.. Junos Static NAT creates a persistent, bidirectional mapping between a private IP and a public IP. Once configured, the same rule handles inbound traffic (translating the public destination IP to the private host) and outbound traffic (translating the private source IP to the public IP) without needing a separate Source NAT rule. This implicit bidirectional behavior is a core feature of Static NAT in Junos, making it ideal for servers that must be reachable from the internet and also initiate outbound connections.

Answer

Static NAT rules must be bound to a security ALG to function bidirectionally.

Answer

Static NAT requires proxy ARP for inbound traffic and static routing tables for outbound traffic translation.

Answer

Static NAT only handles inbound traffic; outbound traffic from the internal host must always be matched by a separate Source NAT pool rule.

Question 2

An administrator creates a Destination NAT rule that translates incoming traffic on public IP 203.0.113.100 to private IP 10.10.10.100. However, when inspecting sessions using 'show security flow session', the translation shows the correct destination IP, but the application traffic fails. Further inspection reveals that the internal server listens on port 8080, whereas the external traffic arrives on port 80. How should the Destination NAT rule be configured to handle this port translation?

Accepted Answer

Define a destination NAT pool that specifies port 8080, and reference this pool in the Destination NAT rule matching port 80 traffic.. Destination NAT in Junos supports port translation through the destination NAT pool configuration. By defining a pool that specifies the translated port (8080) and referencing that pool in the Destination NAT rule that matches incoming traffic on port 80, the SRX rewrites both the destination IP and the destination port. This is the standard way to perform port forwarding with Destination NAT.

Answer

Enable a security ALG for HTTP traffic to automatically remap port 80 to port 8080.

Answer

Configure a Static NAT rule with port override statements under the security policy.

Answer

Change the Junos system service port mapping table globally.

Question 3

Which Junos configuration statement specifies the action taken when a source NAT rule matches traffic?

Accepted Answer

then source-nat. In Junos security NAT configuration, the action taken when a source NAT rule matches is specified with the 'then source-nat' statement, which references the NAT pool or interface for translation. This is the standard Junos syntax for source NAT rule actions.

Answer

nat-action source

Answer

set action source-translation

Answer

action translate source

Question 4

Which Junos command displays summary counters for all configured NAT rule sets across source, destination, and static NAT?

Accepted Answer

show security nat rule-set. To view summary counters and hit counts for NAT rules and rule-sets, 'show security nat summary' or rule-set summary commands are used.

Answer

show security nat summary

Answer

show security flow summary nat

Answer

show system nat counters

Question 5

You are troubleshooting a complex network where Destination NAT forwards traffic to a server farm. Due to high availability requirements, the destination NAT pool contains multiple internal server IP addresses. How does Junos OS distribute incoming destination NAT connections across multiple pool IP addresses?

Accepted Answer

Junos distributes sessions across multiple pool IP addresses using round-robin or hash-based load distribution.. When a destination NAT pool contains multiple IP addresses, Junos distributes incoming sessions across the pool addresses using round-robin or hashing algorithms to achieve load balancing.

Answer

Destination NAT pools only support a single IP address; multiple IPs are reserved exclusively for Source NAT pools.

Answer

Junos always forwards 100% of traffic to the first IP in the pool until that server fails, acting as an active-passive pair.

Answer

Junos requires an external SLB (Server Load Balancer) hardware module to distribute traffic across a destination NAT pool.

Question 6

An administrator configures Static NAT for an internal server. After committing the configuration, the administrator notices that when external clients initiate connections, the session is created, but outbound traffic from the internal server fails to egress with the static NAT IP. Upon checking rule ordering, a broad Source NAT rule for the entire internal subnet is positioned above the static NAT evaluation stage. How does Junos NAT rule ordering resolve this?

Accepted Answer

Because Source NAT is evaluated before Static NAT, the broad Source NAT rule overrides the static NAT translation for outbound traffic.. Source NAT is evaluated before Static NAT in the Junos NAT processing order. If a Source NAT rule matches the internal host's outbound traffic, the Source NAT translation takes precedence over the static NAT source translation, resulting in incorrect IP translation.

Answer

Static NAT rule-sets take precedence only if they reside in the same zone as the destination interface.

Answer

Static NAT is evaluated before Source NAT, so static NAT always takes precedence.

Answer

Source NAT and Static NAT execute in parallel, and Junos randomly selects which translation wins.

Question 7

Which Junos configuration statement defines the match criteria for source address within a Source NAT rule?

Accepted Answer

match source-address 192.168.1.0/24. Within a Source NAT rule, the match criteria for source address is defined using the 'match source-address' statement. This specifies which source IP addresses will be translated by the rule. The correct syntax is 'match source-address <address>', often within a rule under 'security nat source rule-set'.

Answer

address source 192.168.1.0/24

Answer

from source 192.168.1.0/24

Answer

source-address-match 192.168.1.0/24

Question 8

You are troubleshooting a Junos security deployment where Source NAT is configured with a pool. You observe that certain internal applications fail because the external receiving server expects the source port to remain identical to the internal client's ephemeral port (Port Preservation). Which feature or configuration setting should be applied to the source NAT pool to maintain source port numbers whenever possible?

Accepted Answer

Configure port preservation or persistent-nat on the source NAT pool to attempt retaining the original source port.. Junos source NAT pools support port preservation (also referred to as persistent NAT behavior) so that the original source port is retained whenever possible, which is required when external servers expect the same ephemeral port. Configuring this on the source NAT pool is the correct, targeted solution.

Answer

Disable PAT globally so that source NAT operates exclusively as 1:1 without port translation.

Answer

Set the security policy action to 'port-preserve trust'.

Answer

Configure Static NAT instead of Source NAT for all clients requiring port preservation.

Question 9

Which Junos configuration statement specifies the destination address match criteria in a Destination NAT rule?

Accepted Answer

match destination-address 203.0.113.10/32. In Junos destination NAT (also called static NAT or destination NAT), the match criteria for the destination address is specified using the 'match destination-address' statement within the rule, followed by the address or prefix. The correct syntax is 'match destination-address 203.0.113.10/32' (or the address without /32, which Junos interprets as /32). This statement is part of the 'rule' hierarchy under 'security nat destination'.

Answer

address destination-match 203.0.113.10

Answer

destination-address-match 203.0.113.10

Answer

to destination 203.0.113.10

Question 10

An administrator configures a Destination NAT rule. When testing connectivity from an external client, the connection times out. The administrator runs 'show security flow session' and sees sessions in 'Allocate' state but with zero packets processed. What does this operational symptom indicate?

Accepted Answer

The initial packet created the session state, but subsequent packets or return traffic are blocked by security policies or routing failures.. Sessions in 'Allocate' state with zero packets processed indicate that the initial packet created the session state, but subsequent packets or return traffic are blocked by security policies or routing failures. The session is allocated but not yet established, meaning the flow is not fully set up. This points to a policy or routing issue preventing the session from progressing.

Answer

Proxy ARP is corrupting the MAC address of the destination server.

Answer

Junos requires an explicit commit check confirmation before flow packets are processed.

Answer

The Destination NAT pool is out of ports, causing the session allocation table to lock.

Question 11

You are troubleshooting a complex Junos NAT implementation involving both Source NAT and Destination NAT across multiple security virtual routers. A packet is received that matches both a Source NAT rule and a Destination NAT rule in different rule-sets. In what order does the Junos flow engine process these NAT types during packet ingestion?

Accepted Answer

Destination NAT is evaluated and applied first, followed by Source NAT, and then Static NAT.. In Junos flow-based processing, NAT is applied in a strict order: Destination NAT (including static destination NAT) is evaluated first, then Source NAT (including static source NAT). This order ensures that the destination address is translated before the source address, which is critical for correct session lookup and return traffic handling. The flow engine uses the original packet's destination to match destination NAT rules, then applies source NAT based on the translated destination and other criteria. Option A correctly reflects this sequence.

Answer

Source NAT is evaluated first, followed by Destination NAT, and then Static NAT.

Answer

Static NAT is evaluated first, followed by Destination NAT, and then Source NAT.

Answer

All NAT types are evaluated concurrently in a single hardware pipeline pass.

Question 12

Which Junos configuration statement defines the translation action within a Destination NAT rule?

Accepted Answer

then destination-nat pool srv-pool. In Junos security NAT configuration, the translation action inside a Destination NAT rule is expressed with the 'then destination-nat pool ' statement. The 'then' keyword introduces the action clause of the rule, and 'destination-nat pool' specifies that matching traffic's destination IP should be rewritten using the named pool. This is the exact syntax Junos expects under 'security nat destination rule rule-match' context.

Answer

action destination pool srv-pool

Answer

translate destination pool srv-pool

Answer

set destination-nat translate pool srv-pool

Question 13

Which Junos configuration command displays the active NAT translation mappings and session details for a specific source IP address?

Accepted Answer

show security flow session match source-prefix 192.168.1.50. The command 'show security flow session match source-prefix 192.168.1.50' displays active session details filtered by the source IP address, including NAT translation information. This is the correct operational command to view NAT mappings and session details for a specific source IP.

Answer

show security nat translation match 192.168.1.50

Answer

show route forwarding-table source 192.168.1.50

Answer

show system nat sessions source 192.168.1.50

Question 14

You are troubleshooting a performance issue on an SRX device performing heavy NAT operations. You suspect that NAT translation table entries are consuming excessive system resources. Which command displays overall system-wide NAT translation summary information and resource allocation?

Accepted Answer

show security flow statistics. To view overall resource usage, session counts, and NAT translation summary statistics, the command 'show security flow statistics' or specific NAT summary operational commands are used.

Answer

show route forwarding-table nat-summary

Answer

show system resources nat-table

Answer

show security nat memory-allocation

Question 15

An administrator configures Source NAT with a pool. To ensure that traffic matching the NAT rule is logged, where should security logging be enabled for NAT sessions in Junos OS?

Accepted Answer

In the security policy permitting the traffic, by adding logging action modifiers.. In Junos OS on SRX, NAT session logging is enabled through the security policy that permits the traffic, using the 'log' action modifier (e.g., 'then log session-init' or 'then log session-close'). NAT itself does not have a separate logging mechanism at the rule-set or pool level; the security policy is the enforcement point that determines whether a session is logged. This is why option D is correct.

Answer

Under the security nat source rule-set hierarchy using the 'log session' statement.

Answer

Within the NAT pool definition using the 'log-allocations' command.

Answer

Globally under the 'system syslog facility security' hierarchy.