156-215.81.20 Security Policy and NAT Practice Question
A security administrator at a company with a Check Point R81 management server and two clustered Security Gateways is configuring NAT for a web server on the internal network. The server's private IP is 192.168.10.50, and it must be reachable from the Internet at public IP 203.0.113.25. The administrator wants to ensure that return traffic from the server is automatically translated back to the public IP without creating a separate outbound NAT rule. Which NAT method should be configured on the web server object in SmartConsole?
⚠ Common exam trap
The trap here is assuming that Hide NAT can provide inbound access to a server, when it only handles outbound connections and does not create a static mapping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automatic Static NAT
Automatic Static NAT on the web server object provides a one-to-one bidirectional translation between the private IP and the public IP. It automatically generates both inbound and outbound NAT rules in the rulebase, so return traffic from the server is translated back to the public IP without manual intervention. This meets the requirement of avoiding a separate outbound rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Automatic Hide NAT
Why it's wrong here
Automatic Hide NAT on the server object would translate outbound traffic to the gateway's external IP, not to 203.0.113.25. It also does not provide inbound reachability to the server. The requirement is for a static, bidirectional mapping, which Hide NAT cannot provide because it is designed for many-to-one outbound translation.
- ✗
Manual Hide NAT rule
Why it's wrong here
Hide NAT is used to conceal multiple internal IP addresses behind a single public IP for outbound connections. It does not create a static, one-to-one mapping and cannot make an internal server reachable from the Internet at a fixed public IP. Additionally, a manual rule would require a separate outbound rule, which the administrator wants to avoid.
- ✓
Automatic Static NAT
Why this is correct
Automatic Static NAT on the server object creates both an inbound and an outbound translation rule. Inbound traffic to 203.0.113.25 is translated to 192.168.10.50, and outbound traffic from 192.168.10.50 is translated back to 203.0.113.25. This bidirectional mapping is generated automatically in the NAT rulebase, eliminating the need for a separate manual outbound rule.
- ✗
Manual Static NAT rule with a separate outbound rule
Why it's wrong here
While manual Static NAT rules can achieve the translation, they require an explicit outbound rule to handle return traffic. The administrator specifically wants to avoid creating a separate outbound rule. Automatic Static NAT achieves the same result with a single object configuration, making it the more efficient and appropriate choice here.
Visual reference
About these practice questions
This 156-215.81.20 question is part of Courseiva's 210-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-215.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-215.81.20 exam.