JNCIA-SEC Network Address Translation Practice Test 4 — 15 Questions

Question 1

An administrator is designing a source NAT implementation on an SRX Series device for a large branch office. The design must allow many internal hosts to share a small public pool while avoiding port exhaustion, and must ensure that return traffic is correctly handled. Which two statements about source NAT pool behavior and session handling are correct? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

When a source NAT pool is exhausted, the device can be configured to fall back to interface-based translation if a fallback option is enabled in the pool configuration.. Source NAT pools use port translation so many hosts can share few public addresses, and the session table records both original and translated tuples to handle return traffic. The fallback option allows the device to use the interface address when the pool is exhausted, preserving connectivity. Policies match the original internal addresses because translation occurs before policy evaluation.

Answer

Source NAT pools always require a one-to-one mapping between internal hosts and public addresses, so a pool of ten addresses can support only ten concurrent internal hosts.

Answer

Source NAT translation occurs after the security policy lookup, so policies must reference the translated public addresses rather than the internal private addresses.

Answer

Source NAT pools can only be used with a single egress interface, and traffic leaving through any other interface will bypass NAT entirely.

Question 2

You are designing a source NAT solution for a large campus with many internal users accessing the Internet through an SRX Series device. The design must support a high volume of concurrent sessions and avoid port exhaustion, while preserving some session affinity for external services that require it. Which TWO Junos source NAT pool configuration elements should you consider? (Choose two.)

Accepted Answer

port range configuration. To support many concurrent sessions without port exhaustion, the pool should include multiple addresses and a defined port range so that ports are distributed efficiently. Enabling address-persistent behavior helps maintain session affinity by keeping an internal host mapped to the same translated address, which benefits external services that expect consistency.

Answer

routing-instance

Answer

proxy-arp

Answer

port-overloading

Question 3

An administrator is troubleshooting a source NAT configuration on an SRX Series device. Traffic from the trust zone to the untrust zone is not being translated. The administrator has verified that the source NAT rule set is correctly configured with a pool and that the security policy permits the traffic. Which two actions should the administrator take to further diagnose the issue? (Choose two.)

Accepted Answer

Verify that the source NAT rule set includes a from zone trust and to zone untrust match condition.. When source NAT is not translating traffic despite a correct pool and policy, the most likely causes are incorrect zone match conditions in the NAT rule set or a preceding rule set that matches first. Checking the from/to zones and the order of rule sets are the correct diagnostic steps. Pool capacity and routes to the pool are not relevant to why translation is not occurring.

Answer

Confirm that the security policy includes the application junos-http and junos-https.

Answer

Verify that the SRX has a route to the source NAT pool addresses.

Answer

Ensure that the source NAT pool has enough IP addresses to accommodate all concurrent sessions.

Question 4

An administrator is troubleshooting a persistent NAT configuration on an SRX Series device. Internal host 10.1.1.100 needs to communicate with an external server, and the external server must be able to initiate a connection back to the internal host using the same public IP and port that were used for the outbound session. The administrator configures persistent NAT with the following statements: set security nat source rule-set rs1 rule r1 then source-nat pool p1 persistent-nat permit any-remote-host. However, the return connection fails. Which statement explains why the return connection is failing?

Accepted Answer

The persistent-nat permit any-remote-host option allows any remote host to initiate a connection, but the external server's return traffic is being blocked by a security policy that does not permit the inbound session.. Persistent NAT maintains the NAT binding and permits external hosts to initiate connections to the internal host using the translated address and port. However, the SRX still applies security policy to the inbound traffic. If the policy does not allow the return connection from the external server to the internal host, the connection will be blocked. Thus, the missing security policy is the reason the return connection fails.

Answer

The persistent-nat feature only works with destination NAT, not source NAT, so the configuration cannot function as intended.

Answer

Persistent NAT requires the source NAT pool to be configured with address-persistent instead of persistent-nat, which is why the return connection fails.

Answer

The persistent-nat permit any-remote-host option is incorrect because it should be permit any-remote-host any-remote-port, which is required for return traffic.

Question 5

An administrator is troubleshooting a NAT issue on an SRX Series device and wants to view active NAT sessions to verify whether source translation is happening. Which operational command should be used?

Accepted Answer

show security flow session. The command 'show security flow session' displays active flow sessions on the SRX, including source and destination addresses, ports, and NAT translations. It is the primary operational command to verify whether source NAT is being applied and to inspect session state. Administrators use it to confirm that a session exists and that the translated address/port is correct.

Answer

show security nat translation summary

Answer

show system nat active-translations

Answer

show route forwarding-table destination nat

Question 6

An administrator needs to configure Destination NAT to map incoming traffic destined for a public IP address (203.0.113.50) on port 443 to an internal web server at private IP address (192.168.1.100) on port 8443. Which configuration hierarchy is used to define the pool for this destination NAT mapping?

Accepted Answer

set security nat destination pool web-pool address 192.168.1.100 port 8443. Destination NAT pools in Junos are defined under the [security nat destination] hierarchy, where the pool name and its translated address/port are configured. The correct command 'set security nat destination pool web-pool address 192.168.1.100 port 8443' creates the pool that the destination NAT rule will reference in its 'then destination-nat pool' action. This is the pool definition step, distinct from the rule-set/rule that performs the actual matching and translation binding.

Answer

set security nat destination rule-set rs1 rule r1 then translation pool web-pool

Answer

set security nat source pool web-pool address 192.168.1.100 port 8443

Answer

set security nat static rule-set static-rs rule r1 then destination-nat pool web-pool

Question 7

A network engineer implements pool-based Source NAT with Port Address Translation (PAT) on a Junos OS device using a pool containing a single public IP address. After deployment, users in the trust zone experience intermittent failures when opening numerous concurrent browser tabs to various internet sites. 'show security flow session' reveals many sessions in a closing state. What is the root cause?

Accepted Answer

Port exhaustion has occurred because all available source ports for the single translation IP are in use.. With pool-based Source NAT using PAT, all sessions from the trust zone are translated to the single public IP in the pool, and each session consumes a unique source port from that IP. When concurrent sessions exceed the available port range (approximately 64,000 minus reserved ports), new sessions cannot be allocated a translation port, causing intermittent failures and sessions stuck in a closing state as they age out.

Answer

The security policy action is set to permit instead of translating, causing port reuse collisions.

Answer

The source NAT pool lacks the 'port-overloading' statement, causing the device to drop excess traffic.

Answer

Junos OS requires an explicit maximum-sessions limit per pool address to prevent CPU overload.

Question 8

An administrator configures interface-based Source NAT on the outgoing external interface of a SRX Series device. However, internal hosts report being unable to reach external web servers. Upon checking the security flow session, the administrator notices that packets are egressing the interface with the actual internal private IP address rather than the interface IP. What is the most likely cause?

Accepted Answer

The source NAT rule is missing the 'then source-nat interface' action statement.. Interface-based Source NAT on a Juniper SRX requires the explicit action statement 'then source-nat interface' within the NAT rule. Without this action, the NAT rule matches traffic but performs no translation, so packets egress with their original private source IP, causing return traffic to fail. The security flow session showing the internal IP confirms the NAT action is missing.

Answer

The security policy is evaluating the post-translation source IP instead of the pre-translation IP.

Answer

Proxy ARP must be manually enabled on the internal interface for interface-based NAT to function.

Answer

Interface-based Source NAT requires an explicit routing instance to bypass the master routing table.

Question 9

An administrator configures Destination NAT so that traffic arriving on the external interface destined for IP 198.51.100.25 is translated to 10.0.0.5. After applying the configuration, internal hosts on the trust zone attempt to access 198.51.100.25 and fail. What feature is required to allow internal hosts to access a server hosted inside their own network via its public IP address?

Accepted Answer

Configure source NAT for traffic originating from the internal zone destined back to the internal zone (Hairpin NAT).. Hairpin NAT (also called NAT loopback or U-turn NAT) is required when internal hosts need to access an internal server via its public IP address. Without it, the destination NAT rule translates the public IP to the internal server IP, but the server's reply goes directly to the internal host's private IP, bypassing the SRX and causing the connection to fail because the source IP does not match the expected public IP. Hairpin NAT ensures that traffic from internal to internal via the public IP is also source-NATed so that return traffic flows back through the SRX.

Answer

Change the destination NAT rule to evaluate source zones as 'any' instead of 'untrust'.

Answer

Enable proxy ARP on the internal interface for the public destination IP address.

Answer

Configure a static route on the internal hosts pointing directly to the internal server IP.

Question 10

Which Junos configuration block is required to define a static NAT rule set mapping external IP addresses to internal servers?

Accepted Answer

set security nat static rule-set from zone . Static NAT on Junos SRX is configured under the [edit security nat static] hierarchy, and each rule-set must be bound to a zone using the 'from zone ' statement. The correct syntax is 'set security nat static rule-set from zone ', which defines the rule-set and its source zone context. This is the required starting block before adding rule definitions and host mappings.

Answer

set security policies from-zone to-zone static-nat

Answer

set security nat destination rule-set from zone

Answer

set security nat source rule-set from zone

Question 11

An administrator has configured multiple rules within a single Source NAT rule-set. When traffic traverses the SRX device, how does Junos OS determine which specific rule within the rule-set is applied?

Accepted Answer

Rules are evaluated top-down; the first rule matching the packet's criteria is applied.. In Junos OS Source NAT rule-sets, rules are evaluated in the order they are configured, from top to bottom. The first rule whose match criteria (source address, destination address, etc.) are satisfied by the packet is applied, and no further rules are evaluated. This deterministic order allows administrators to prioritize specific translations.

Answer

Rules are evaluated based on specificity; the most specific match is always applied regardless of configuration order.

Answer

Rules are evaluated using hashing algorithms to distribute translation loads evenly across rules.

Answer

All matching rules are combined, and translations are applied concurrently.

Question 12

You are troubleshooting a Destination NAT rule where traffic matching the rule is dropped. You run 'Traceoptions' for security flow and notice that the packet hits the destination NAT rule, translates successfully, but then fails. Examining the trace output reveals: 'No route found: 10.1.1.50 -> 0.0.0.0'. What is the underlying cause?

Accepted Answer

The routing table lacks a valid route to the post-translation internal IP address.. The trace message 'No route found: 10.1.1.50 -> 0.0.0.0' indicates that after destination NAT translated the packet to internal IP 10.1.1.50, the SRX could not find a route to forward the packet toward that address. This means the routing table lacks a valid route to the post-translation destination subnet, so the packet is dropped after successful NAT translation.

Answer

Proxy ARP is not enabled on the internal server interface.

Answer

The security policy is missing the pre-translation public IP address in the destination field.

Answer

The destination NAT pool port translation is misaligned with the server listening port.

Question 13

Which command is used to clear active NAT sessions on an SRX Series device during troubleshooting?

Accepted Answer

clear security flow session. On Juniper SRX Series devices, active NAT sessions are stored in the flow session table, and the correct command to clear them is 'clear security flow session'. This command removes the session entries, forcing traffic to re-establish sessions and re-evaluate NAT and security policies. It is the standard troubleshooting step when stale NAT translations cause connectivity issues.

Answer

reset security nat sessions

Answer

clear route forwarding-table nat

Answer

clear security nat translation cache

Question 14

Which keyword is used in a Junos source NAT rule to specify that traffic should be translated to the IP address of the egress interface?

Accepted Answer

interface. In a Junos source NAT rule, the 'interface' keyword tells the SRX to translate the source address to the IP address of the egress interface. This is configured under 'then source-nat interface' within the rule. It is the standard way to perform interface-based PAT without defining an address pool.

Answer

address-pool

Answer

egress-ip

Answer

self

Question 15

An administrator configures a Source NAT rule-set with 'from zone trust' and 'to zone untrust'. Internal users can successfully browse the internet. Later, a new interface and zone (DMZ) are added, and hosts in the DMZ also need Source NAT to the untrust zone using the same pool. What is the most efficient way to achieve this?

Accepted Answer

Modify the existing rule-set to include the DMZ zone in the 'from zone' statement, or create an additional rule-set for the DMZ zone.. The most efficient approach is to either modify the existing rule-set's 'from zone' statement to include the DMZ zone (if the same pool and translation are desired) or create an additional rule-set for the DMZ zone. This reuses the existing NAT pool and configuration without global changes, preserving the trust zone rule-set's specificity.

Answer

Enable global NAT mode under the system hierarchy to automatically apply NAT across all zones.

Answer

Delete the trust zone rule-set and recreate it globally without specifying any source zone.

Answer

Configure static routes from the DMZ zone directly to the untrust zone to bypass NAT requirements.