JNCIA-SEC Network Address Translation Practice Question
An administrator configures Destination NAT to forward incoming traffic on port 80 to an internal server. After committing, the administrator notices that ping tests to the destination NAT public IP address fail. What is the standard behavior of Destination NAT regarding ICMP ping requests?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Destination NAT rules matching specific TCP/UDP ports do not translate ICMP ping traffic, leading to failed pings unless ICMP is explicitly matched.
Destination NAT rules that specify port translation or specific application ports translate TCP/UDP flows, but ICMP packets do not contain ports. Unless explicit ICMP or static/destination NAT rules match ICMP protocol without port dependencies, ping requests to destination NAT virtual IPs may not translate or respond unless specifically handled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ICMP ping requests are dropped by the Junos control plane as a security hardening default.
Why it's wrong here
Drops are governed by security policies and flow rules, not a global ICMP drop hardening default for NAT.
- ✗
Destination NAT automatically translates and responds to all ICMP echo requests by default.
Why it's wrong here
Destination NAT does not automatically translate ICMP without appropriate match criteria.
- ✗
Proxy ARP on the external interface prevents ICMP echo requests from reaching the Destination NAT engine.
Why it's wrong here
Proxy ARP answers ARP requests, allowing the packet to reach the SRX interface; the issue is protocol/port matching.
- ✓
Destination NAT rules matching specific TCP/UDP ports do not translate ICMP ping traffic, leading to failed pings unless ICMP is explicitly matched.
Why this is correct
ICMP lacks transport ports; rules configured with specific port match criteria will ignore ICMP ping packets unless an ICMP-specific match rule exists.
Visual reference
About these practice questions
This JNCIA-SEC question is part of Courseiva's 513-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Juniper Networks exam blueprint
This JNCIA-SEC practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JNCIA-SEC exam.