JNCIA-SEC Network Address Translation Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are valid types of Network Address Translation supported on Juniper Networks SRX Series devices running Junos OS? (Choose two)

Accepted Answer

Source NAT. Source NAT (option A) is a valid and fundamental NAT type on Juniper SRX devices, used to translate the source IP address of outbound traffic (e.g., using interface or pool-based translation) so internal hosts can reach external networks. Destination NAT (option D) is also valid and is used to translate the destination IP address of inbound traffic, commonly for publishing internal servers to the internet or port forwarding. Junos OS on SRX supports these NAT types through source NAT, destination NAT, and static NAT rule configurations. The remaining options are not recognized NAT types on SRX: Transparent NAT (B) is not a Junos NAT category, Dynamic Layer 2 NAT (C) is not a supported SRX NAT type, and Asymmetric Routing NAT (E) describes a routing condition rather than a NAT type.

Answer

Transparent NAT

Answer

Dynamic Layer 2 NAT

Answer

Asymmetric Routing NAT

Question 2

When configuring a Source NAT pool on a Junos OS device, which TWO parameters can be specified within the pool configuration hierarchy? (Choose two)

Accepted Answer

address range. Option C (address range) is correct because a Junos source NAT pool is defined under the [edit security nat source pool] hierarchy with the address or address-range statement, which specifies the IP addresses (or contiguous range) from which translated source addresses are allocated. Option D (port overloading settings) is correct because the same pool hierarchy supports port overloading via the 'overloading' statement (and related port range/port-overloading-factor settings), which allows multiple hosts to share a single translated address by multiplexing ports. Options A, B, and E are not valid pool parameters: security zone binding is configured at the rule/rule-set level (e.g., 'from zone'/'to zone'), firewall filters are attached via 'apply-groups' or interface/filter configuration rather than inside the NAT pool, and routing instance next-hop is not a source NAT pool setting (routing instances are referenced elsewhere, such as in the NAT rule or routing-options).

Answer

security zone binding

Answer

firewall filter attachment

Answer

routing instance next-hop

Question 3

Which TWO configuration components are mandatory when defining a Source NAT rule-set in Junos OS? (Choose two)

Accepted Answer

from zone. In a Junos OS Source NAT rule-set, the mandatory match criteria are the from zone and to zone statements, which define the direction of traffic the rule-set applies to. Option A (from zone) is correct because every Source NAT rule-set must specify the source security zone from which traffic originates, so the device knows which traffic to match for translation. Option C (to zone) is correct because the rule-set must also specify the destination security zone, completing the zone-pair match that determines when the source NAT rule is evaluated. Options B, D, and E are not mandatory components of a Source NAT rule-set: routing-instance binding is optional and used only in specific scenarios, interface MTU specification is unrelated to NAT rule-set definition, and global ARP timeout is a system-level setting, not part of a NAT rule-set configuration.

Answer

routing-instance binding

Answer

interface MTU specification

Answer

global ARP timeout

Question 4

Which TWO methods can be used to perform Source NAT on a Junos OS SRX Series device? (Choose two)

Accepted Answer

Interface-based Source NAT. Interface-based Source NAT (option D) is correct because on Junos OS SRX devices you can configure source NAT directly on the egress interface using the 'interface' statement, which translates the source address to the interface's IP address (or an address from its subnet) without defining a separate NAT pool. Pool-based Source NAT (option E) is also correct because Junos SRX supports defining a source NAT pool with the 'pool' statement, allowing translation to one or more addresses in that pool, optionally with port address translation. These are the two standard source NAT configuration methods on SRX. The other options are not valid Junos SRX NAT types: 'Broadcast Source NAT' (A) is not a supported NAT method, 'Policy-less Source NAT' (B) is not a Junos term since source NAT is configured within a security policy or as a NAT rule, and 'Loopback-based Source NAT' (C) is not a recognized source NAT mechanism on SRX.

Answer

Broadcast Source NAT

Answer

Policy-less Source NAT

Answer

Loopback-based Source NAT

Question 5

Which TWO statements are correct regarding the evaluation order and behavior of NAT in Junos OS? (Choose two)

Accepted Answer

Destination NAT is evaluated before Source NAT.. Option B is correct because in Junos OS NAT processing, destination NAT is evaluated before source NAT; the destination address/port translation happens first so that the subsequent source NAT lookup and any related session/flow decisions operate on the already-translated destination. Option E is correct because within a given NAT rule-set, rules are evaluated sequentially from top to bottom, and the first matching rule is applied, so rule order matters. Options A, C, and D are not correct: source NAT rule-sets do consider source zones (they are matched based on source zone and other match criteria), NAT rules are not all evaluated simultaneously via longest-prefix matching, and static NAT is not evaluated before destination NAT in the Junos NAT order of operations.

Answer

Source NAT rule-sets ignore source zones during packet processing.

Answer

All NAT rules are evaluated simultaneously using longest-prefix matching.

Answer

Static NAT is evaluated before Destination NAT.

Question 6

When configuring Destination NAT and Static NAT on Junos OS, which THREE requirements must be met for inbound traffic to successfully reach an internal server? (Choose three)

Accepted Answer

A security policy must permit traffic from the external zone to the internal zone using the post-translation IP address.. Option B is correct because Junos security policies are evaluated against the post-translation (translated) destination address, so the policy permitting external-to-internal traffic must reference the internal server's private IP, not the public IP. Option D is correct because after NAT translation the device must forward the packet to the internal server, which requires a valid route in the routing table toward the post-translation internal IP address. Option E is correct because inbound traffic only reaches the internal server if a matching Destination NAT or Static NAT rule actually translates the incoming packet's destination address. Option A is incorrect because Junos policies match the translated address, not the pre-translation public IP. Option C is incorrect because Proxy ARP is typically required on the external interface (not disabled on internal interfaces) so the device can answer ARP requests for the public NAT address.

Answer

The security policy must reference the pre-translation public IP address.

Answer

Proxy ARP must be disabled on all internal interfaces.

Question 7

Which THREE conditions or configurations can cause asymmetric routing or session drops when implementing Destination NAT or Static NAT? (Choose three)

Accepted Answer

The internal server's default gateway does not point to the SRX device.. Option A is correct because when the internal server's default gateway does not point to the SRX device, return traffic from the server bypasses the SRX, so the firewall only sees the inbound (pre-translation) flow and the session becomes asymmetric or is dropped due to missing return packets. Option B is correct because SRX security policies are evaluated against the post-translation (translated) addresses and zones, so a policy that permits the original destination but blocks the translated destination/zone will drop the flow after NAT processing. Option E is correct because without hairpin NAT (also called U-turn or NAT reflection), internal clients using the server's public IP send traffic to the SRX, but the SRX cannot correctly translate and route the flow back to the same internal server, causing session drops or asymmetric routing. Option C is not a cause of asymmetric routing or session drops; top-down sequential rule evaluation is simply the normal SRX policy evaluation order. Option D is not a cause either; Proxy ARP on the external egress interface is a common and often necessary configuration for NAT to allow the SRX to answer ARP for translated addresses, and enabling it does not by itself create asymmetric routing or session drops.

Answer

Configuring top-down sequential rule evaluation.

Answer

Enabling Proxy ARP on the external egress interface.

Question 8

Which TWO statements describe the behavior of Static NAT on Junos OS devices? (Choose two)

Accepted Answer

It provides a one-to-one mapping between a public IP address and a private IP address.. Option A is correct because Static NAT on Junos OS creates a fixed one-to-one mapping between a private (inside) IP address and a public (outside) IP address, so each host keeps a dedicated public address rather than sharing one. Option B is correct because Static NAT is inherently bidirectional: the same static mapping is used for outbound source translation and inbound destination translation, allowing external hosts to initiate sessions to the internal host without a separate rule. Option C is wrong because Static NAT does not require interface-based NAT; interface-based NAT is a separate Junos feature used for interface address translation, not a prerequisite for static mappings. Option D is wrong because port overloading (PAT) is used by source NAT with interface or pool translation to share one public IP among many hosts, whereas Static NAT is strictly one-to-one. Option E is wrong because in the Junos NAT processing order, Destination NAT is evaluated before Source NAT (and static NAT rules are processed within those types), so Static NAT is not evaluated before Destination NAT.

Answer

It requires interface-based NAT to function on external ports.

Answer

It requires port overloading (PAT) to share a single public IP among multiple hosts.

Answer

It is evaluated before Destination NAT in the Junos NAT processing order.

Question 9

Which TWO Junos CLI commands are valid configuration shortcuts or roots when managing security NAT? (Choose two)

Accepted Answer

show security nat rule-set. Option D, 'edit security nat', is correct because it is the valid configuration hierarchy root for all security NAT configuration on Junos (SRX), from which you can navigate into source, destination, static, and other NAT stanza types. Option A, 'show security nat rule-set', is correct because it is a valid operational-mode shortcut that displays configured NAT rule sets and their rules directly, without requiring you to enter the full 'show configuration security nat' path. Option B, 'edit system nat-mode', is not valid because NAT mode is not configured under the 'system' hierarchy in Junos security configuration. Option C, 'edit routing-options nat-pool', is not valid because NAT pools are defined under the security NAT hierarchy, not under routing-options. Option E, 'show firewall nat-status', is not a real Junos command; NAT status is inspected via security nat operational commands, not a firewall nat-status shortcut.

Answer

edit system nat-mode

Answer

edit routing-options nat-pool

Answer

show firewall nat-status

Question 10

When configuring Proxy ARP for Static NAT or Destination NAT on an SRX Series device, which THREE operational or configuration practices must be considered? (Choose three)

Accepted Answer

Proxy ARP must be enabled on the external interface facing the upstream router.. Option A is correct because proxy ARP must be enabled on the external (untrusted) interface that faces the upstream router, so the SRX can answer ARP requests for the NAT public IP addresses it owns on behalf of those addresses. Option B is correct because the public IPs used in static or destination NAT must fall within the subnet configured on the external interface; otherwise the upstream router would not ARP for them on that link and proxy ARP could not respond. Option D is correct because when the SRX answers ARP for the NAT public addresses, the upstream router can reach those addresses directly over the connected subnet, removing the need for a static route pointing to the SRX for those public IPs. Option C is wrong because proxy ARP operates at Layer 2/ARP and does not perform port address translation or any ICMP PAT function. Option E is wrong because proxy ARP is relevant to external reachability of NAT addresses, not to internal trusted clients accessing local servers, which relies on normal routing and security policies.

Answer

Proxy ARP automatically performs port address translation for ICMP packets.

Answer

Proxy ARP is required for internal trusted interface clients accessing local servers.

Question 11

Which TWO statements are true regarding Junos NAT rule-sets? (Choose two)

Accepted Answer

Rule-sets define the security zones (from zone and to zone) where the NAT logic applies.. NAT rule-sets group NAT rules and require source and destination security zones.

Answer

Rule-sets are limited to exactly one rule per zone.

Answer

Rule-sets can only be configured under the routing-options hierarchy.

Question 12

When configuring advanced NAT scenarios on Junos OS, which THREE statements regarding NAT and security policies are correct? (Choose three)

Accepted Answer

Security policies for Source NAT evaluate the pre-translation internal source IP address.. Option A is correct because on Junos SRX, security policy lookup for a Source NAT flow matches the original (pre-translation) source IP address of the internal host, so the policy must permit that pre-NAT source address. Option D is correct because for Destination NAT, the policy is evaluated against the translated (post-NAT) destination IP address, i.e., the internal server's real address, not the public address the client originally targeted. Option E is correct because NAT and policy processing depend on the correct zones: the ingress zone is determined by the pre-NAT incoming interface and the egress zone by the post-NAT outgoing interface, so policies must reference those zones accurately for the flow to be permitted. Option B is wrong because NAT rule evaluation order is deterministic (rule-set/rule order) and security policies do not override NAT ordering to resolve conflicts. Option C is wrong because NAT processing occurs before security policy evaluation in the SRX packet flow, not after, which is precisely why policies see pre-NAT source and post-NAT destination addresses.

Answer

Security policies automatically override NAT rule evaluation order if a conflict arises.

Answer

Security policies are evaluated before any NAT processing occurs on the SRX device.

Question 13

When configuring Static NAT on a Junos OS device, which THREE operational or design considerations are vital for correct multi-service deployments? (Choose three)

Accepted Answer

Routes to the internal private IP addresses must be present in the routing table for successful packet forwarding.. Option A is correct because Static NAT only rewrites addresses; the device still needs a route to the internal private IP (for example, via the inside interface or a next-hop) so that translated packets can be forwarded to the real host. Option C is correct because Static NAT creates a fixed one-to-one binding that is inherently bidirectional, translating inbound destination addresses to the private host and outbound source addresses back to the public address without a separate reverse rule. Option E is correct because when the public static IP is not directly assigned to the external interface, the Junos device must answer ARP requests for that address on behalf of the internal host, which is done by enabling proxy ARP on the external interface. Option B is not correct because Static NAT is one-to-one and does not use port overloading; port overloading (PAT) belongs to interface or source NAT pool configurations. Option D is not correct because Junos NAT rule evaluation order is determined by rule-set ordering and type, and Static NAT is not universally evaluated before Destination NAT rule-sets as a fixed design rule.

Answer

Static NAT requires explicit port-overloading pool definitions for HTTP traffic.

Answer

Static NAT rules are evaluated before Destination NAT rule-sets.

Question 14

Which THREE Junos CLI configuration commands or hierarchies are correctly associated with defining Source, Destination, or Static NAT rule-sets? (Choose three)

Accepted Answer

set security nat source rule-set from zone . Option A is correct because Source NAT rule-sets are defined under the [security nat source] hierarchy and must specify a from zone (and typically a to zone) to match traffic, so 'set security nat source rule-set from zone ' is valid. Option C is correct because Destination NAT rule-sets live under [security nat destination] and likewise use a from zone match condition, making 'set security nat destination rule-set from zone ' a valid command. Option D is correct because Static NAT rule-sets are configured under [security nat static] and also require a from zone (and to zone) match, so 'set security nat static rule-set from zone ' is properly associated with Static NAT. Option B is incorrect because there is no 'security nat interface-rule-set' hierarchy in Junos; interface-based NAT is configured within source or destination rule-sets using 'interface' match conditions, not a separate interface-rule-set. Option E is incorrect because there is no 'security nat global rule-set' hierarchy; global NAT behavior is handled via 'set security nat source/destination ...' options such as 'proxy-arp' or 'port-overloading', not a global rule-set.

Answer

set security nat interface-rule-set <name>

Answer

set security nat global rule-set <name>

Question 15

An SRX Series device performs source NAT for outbound traffic using an interface-based NAT configuration on ge-0/0/0. Users report that some external services see connections from many different public addresses, even though only one ISP link is in use. You verify that the interface has a single public address. Which configuration element should you inspect to determine why multiple translated addresses appear?

Accepted Answer

The interface on which the NAT is applied, to verify whether multiple logical units or addresses are present.. With interface-based source NAT, the translated address is taken from the egress interface. If that interface has more than one address or logical unit, different sessions can be translated to different addresses, which matches the reported symptom. The interface configuration is therefore the key element to inspect before changing any NAT rule or match condition.

Answer

The security nat source rule-set rule match source-address and destination-address entries, to confirm which traffic is being translated.

Answer

The proxy-arp setting on the internal interface, to confirm that ARP responses are being generated for translated addresses.

Answer

The session timeout values in the flow configuration, to determine whether sessions are expiring too quickly.