Knowledge + Practice

CCNA Network Address Translation Questions

55 questions · Network Address Translation · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQmedium

An administrator needs to allow external users to access an internal server at 10.1.1.100 using the public IP address 203.0.113.20 on port 443. The administrator configures a destination NAT rule. Which additional configuration is required to permit this traffic?

A.A route on the SRX pointing to 203.0.113.20 via the trust zone interface.

B.A security policy from the untrust zone to the trust zone that permits traffic to the translated destination IP 10.1.1.100 on port 443.

C.A source NAT rule that translates the external user's IP address to the SRX's untrust interface address.

D.A static NAT rule mapping 203.0.113.20 to 10.1.1.100, because destination NAT alone cannot translate ports.

AnswerB

After destination NAT translates the public IP to the internal server IP, the security policy is evaluated against the translated destination address. Therefore, a policy from untrust to trust permitting traffic to 10.1.1.100 on port 443 is required. Without this policy, the traffic will be dropped even though NAT is configured. This is a fundamental step in publishing internal services.

Why this answer

Destination NAT translates the public IP to the internal server IP before the security policy is evaluated. Therefore, the policy must permit traffic to the translated address. A policy from untrust to trust allowing traffic to 10.1.1.100 on port 443 is necessary.

Source NAT, static NAT, or additional routes do not fulfill this requirement.

Exam trap

The trap here is thinking that the security policy should reference the original public IP; however, Junos OS evaluates policies against the translated destination address.

Practice this question →

2

Multi-Selecteasy

Which TWO elements are required within a Junos Destination NAT rule definition? (Choose two)

Select 2 answers

A.Global routing instance override

B.Interface MTU command

C.Then destination-nat pool statement

D.Source NAT pool binding

E.Match destination-address statement

AnswersC, E

The destination-nat pool statement defines the translated address set that traffic is rewritten to, satisfying the requirement for a translation target within the rule. Without it, Junos has no address to substitute, so the rule cannot perform destination NAT. It pairs with the rule match conditions to complete the definition.

Why this answer

In a Junos Destination NAT rule, the match destination-address statement (option E) is required because it identifies which original destination IP address (or prefix) the rule applies to, and without a match condition the rule cannot select traffic for translation. The then destination-nat pool statement (option C) is also required because it specifies the pool of translated destination addresses that the matched traffic will be rewritten to, completing the NAT action. Options A, B, and D are not required elements of a Destination NAT rule: a global routing instance override is an optional routing-instance setting, an interface MTU command is unrelated to NAT rule definition, and a source NAT pool binding belongs to Source NAT configuration rather than Destination NAT.

Exam trap

JNCIA-SEC often tests required rule elements by mixing in optional or unrelated statements (routing instance, MTU, source NAT pool) — candidates who do not know the minimal required match/action pair may select extras.

Practice this question →

3

MCQhard

You are troubleshooting a Destination NAT rule where traffic matching the rule is dropped. You run 'Traceoptions' for security flow and notice that the packet hits the destination NAT rule, translates successfully, but then fails. Examining the trace output reveals: 'No route found: 10.1.1.50 -> 0.0.0.0'. What is the underlying cause?

A.Proxy ARP is not enabled on the internal server interface.

B.The routing table lacks a valid route to the post-translation internal IP address.

C.The security policy is missing the pre-translation public IP address in the destination field.

D.The destination NAT pool port translation is misaligned with the server listening port.

AnswerB

After destination NAT rewrites the packet to 10.1.1.50, the device performs a route lookup on that translated address. The 'No route found' message confirms no route exists to the post-translation internal IP, so the packet is dropped.

Why this answer

The trace message 'No route found: 10.1.1.50 -> 0.0.0.0' indicates that after destination NAT translated the packet to internal IP 10.1.1.50, the SRX could not find a route to forward the packet toward that address. This means the routing table lacks a valid route to the post-translation destination subnet, so the packet is dropped after successful NAT translation.

Exam trap

The trap is assuming the problem is NAT-related because the packet 'hits the destination NAT rule' — but the trace clearly shows NAT succeeded and the failure is a routing lookup for the translated address, which is a separate processing stage.

How to eliminate wrong answers

Option A is wrong because proxy ARP affects whether the SRX answers ARP requests for the NAT IP on the external interface — it does not cause a 'no route found' error for the internal translated address. Option C is wrong because security policy matching occurs on the pre-translation or post-translation address depending on configuration, but a missing policy would produce a policy denial log, not a routing error. Option D is wrong because a port translation mismatch would cause the connection to fail at the server or produce a different error, not a routing lookup failure for the IP address.

Practice this question →

4

MCQeasy

Which Junos configuration block is required to define a static NAT rule set mapping external IP addresses to internal servers?

A.set security policies from-zone <zone> to-zone <zone> static-nat

B.set security nat static rule-set <name> from zone <zone>

C.set security nat destination rule-set <name> from zone <zone>

D.set security nat source rule-set <name> from zone <zone>

AnswerB

A static NAT rule set must declare its source zone before rules and then-match clauses are evaluated, so the from zone statement is required to bind the rule set to traffic entering that zone. Without it, the rule set lacks the context Junos needs to apply the static mapping.

Why this answer

Static NAT on Junos SRX is configured under the [edit security nat static] hierarchy, and each rule-set must be bound to a zone using the 'from zone <zone>' statement. The correct syntax is 'set security nat static rule-set <name> from zone <zone>', which defines the rule-set and its source zone context. This is the required starting block before adding rule definitions and host mappings.

Exam trap

The trap here is confusing the three NAT types — source, destination, and static — and their respective configuration hierarchies; candidates often pick 'destination' or 'source' because they sound similar, but static NAT has its own 'security nat static' branch.

How to eliminate wrong answers

Option A is wrong because 'static-nat' is not a valid security policy action; policies use permit/deny and reference NAT indirectly via match conditions, not a static-nat keyword. Option C is wrong because 'destination' NAT is a separate NAT type used for destination address translation (not the static NAT rule-set hierarchy). Option D is wrong because 'source' NAT is a different NAT type used for source address translation, not static NAT.

Practice this question →

5

MCQmedium

An administrator has configured multiple rules within a single Source NAT rule-set. When traffic traverses the SRX device, how does Junos OS determine which specific rule within the rule-set is applied?

A.Rules are evaluated top-down; the first rule matching the packet's criteria is applied.

B.Rules are evaluated based on specificity; the most specific match is always applied regardless of configuration order.

C.Rules are evaluated using hashing algorithms to distribute translation loads evenly across rules.

D.All matching rules are combined, and translations are applied concurrently.

AnswerA

Junos OS evaluates rules within a rule-set sequentially from top to bottom, applying the first rule whose match conditions the packet satisfies. This satisfies the stem's requirement for determining which specific rule is applied when multiple rules exist in one rule-set.

Why this answer

In Junos OS Source NAT rule-sets, rules are evaluated in the order they are configured, from top to bottom. The first rule whose match criteria (source address, destination address, etc.) are satisfied by the packet is applied, and no further rules are evaluated. This deterministic order allows administrators to prioritize specific translations.

Exam trap

JNCIA-SEC often tests the misconception that NAT rules are evaluated by specificity or that multiple rules can apply, confusing it with firewall policy evaluation where more specific rules might be prioritized.

How to eliminate wrong answers

Option B is wrong because Junos does not evaluate based on specificity; it strictly follows configuration order. Option C is wrong because hashing is used for load balancing in some NAT scenarios (e.g., with multiple addresses in a pool), but not for rule selection. Option D is wrong because only one rule is applied per packet; rules are not combined.

Practice this question →

6

MCQhard

A security administrator needs to ensure that a specific internal host always uses the same public address and port when communicating with an external partner, because the partner's firewall allows only that specific combination. The administrator configures source NAT with a pool and enables persistent NAT. Which statement describes the behavior that satisfies this requirement?

A.Persistent NAT assigns a dedicated public address to the internal host for all destinations, and the port is always preserved from the original source port.

B.Persistent NAT ensures that the internal host always uses the same translated address and port for all sessions to the same destination, as long as the persistent NAT binding remains active.

C.Persistent NAT requires that the pool contain only one address, because multiple addresses would cause the host to use different public addresses for different sessions.

D.Persistent NAT guarantees that the internal host's sessions are never timed out, so the binding remains forever regardless of inactivity.

AnswerB

Persistent NAT creates a binding that keeps the translated address and port consistent for sessions from a given internal host to a specific destination. This satisfies the partner firewall requirement because the external view of the host remains stable for the duration of the binding, which is controlled by the persistent NAT timeout.

Why this answer

Persistent NAT creates a binding that keeps the translated address and port consistent for a given internal host communicating with a specific destination. This is exactly what is needed when an external firewall expects a fixed public address and port combination. The binding is maintained for the duration of the persistent NAT timeout and can be scoped to the destination.

Exam trap

The trap here is assuming that persistent NAT locks a host to a single public address for all destinations, when it actually creates destination-scoped bindings that keep the translated address and port stable for that destination.

Practice this question →

7

MCQeasy

Which Junos configuration command removes an existing Source NAT rule named 'rule1' from a rule-set named 'rs1'?

A.deactivate security nat source rule-set rs1 rule rule1

B.clear security nat rule-set rs1 rule rule1

C.remove security nat source rule-set rs1 rule rule1

D.delete security nat source rule-set rs1 rule rule1

AnswerD

The command targets the exact hierarchy path, deleting rule1 nested under rule-set rs1 within the source NAT stanza. Junos requires the full path to remove a specific rule without disturbing sibling rules or the parent rule-set, satisfying the stem's requirement to remove only that named rule.

Why this answer

The correct Junos command to remove a configuration element is 'delete', followed by the full configuration path. To remove a Source NAT rule named 'rule1' from rule-set 'rs1', the path is 'security nat source rule-set rs1 rule rule1', so 'delete security nat source rule-set rs1 rule rule1' is correct. This removes the rule from the candidate configuration, which must then be committed.

Exam trap

JNCIA-SEC often tests the distinction between 'delete' (removes config) and 'deactivate' (disables config), and candidates frequently confuse configuration-mode commands with operational-mode commands like 'clear'.

How to eliminate wrong answers

Option A is wrong because 'deactivate' only disables the rule (marks it inactive) without removing it from the configuration — the rule remains in the config but is not evaluated. Option B is wrong because 'clear' is an operational-mode command used to clear counters, sessions, or statistics, not to modify configuration. Option C is wrong because 'remove' is not a valid Junos configuration-mode command; Junos uses 'delete' to remove configuration statements.

Practice this question →

8

MCQmedium

An administrator configures Destination NAT so that traffic arriving on the external interface destined for IP 198.51.100.25 is translated to 10.0.0.5. After applying the configuration, internal hosts on the trust zone attempt to access 198.51.100.25 and fail. What feature is required to allow internal hosts to access a server hosted inside their own network via its public IP address?

A.Configure source NAT for traffic originating from the internal zone destined back to the internal zone (Hairpin NAT).

B.Change the destination NAT rule to evaluate source zones as 'any' instead of 'untrust'.

C.Enable proxy ARP on the internal interface for the public destination IP address.

D.Configure a static route on the internal hosts pointing directly to the internal server IP.

AnswerA

Hairpin NAT, or source NAT for intra-zone traffic, rewrites the source address so return packets from the internal server traverse the firewall rather than bypassing it. Without it, the server replies directly to the client, which discards the unexpected response.

Why this answer

Hairpin NAT (also called NAT loopback or U-turn NAT) is required when internal hosts need to access an internal server via its public IP address. Without it, the destination NAT rule translates the public IP to the internal server IP, but the server's reply goes directly to the internal host's private IP, bypassing the SRX and causing the connection to fail because the source IP does not match the expected public IP. Hairpin NAT ensures that traffic from internal to internal via the public IP is also source-NATed so that return traffic flows back through the SRX.

Exam trap

The trap is that candidates focus on the destination NAT rule and overlook the return path; they may think changing the source zone to 'any' will fix it, but the real issue is asymmetric routing that requires source NAT for hairpin traffic.

How to eliminate wrong answers

Option B is wrong because changing the destination NAT rule's source zone to 'any' does not solve the routing asymmetry; the problem is that return traffic from the server bypasses the SRX, not that the rule is not matching. Option C is wrong because proxy ARP is used when the SRX needs to answer ARP requests for a NAT IP on a different subnet; it does not address the hairpin traffic flow. Option D is wrong because adding a static route on internal hosts to the internal server IP would bypass the SRX entirely, but it would not allow access via the public IP and would break the intended NAT behavior.

Practice this question →

9

MCQeasy

Which Junos operational command allows an administrator to verify the configuration syntax and structure of all NAT rules before committing?

A.test security nat syntax

B.commit check

C.verify security nat configuration

D.check nat rules

AnswerB

'commit check' parses the candidate configuration, validating syntax and hierarchy structure without activating it, so NAT rule errors surface before commit. It satisfies the stem's requirement to verify configuration syntax and structure of all NAT rules prior to committing.

Why this answer

The 'commit check' command validates the candidate configuration for syntax errors, semantic errors, and structural issues without committing it. It checks all configuration hierarchies, including security NAT rules, and reports any errors. This is the standard Junos operational command to verify configuration before committing.

Exam trap

JNCIA-SEC often tests the confusion between 'commit check' and non-existent commands like 'test security nat syntax' — candidates may invent plausible-sounding commands instead of recalling the actual Junos validation command.

How to eliminate wrong answers

Option A is wrong because 'test security nat syntax' is not a valid Junos command; there is no such operational command. Option C is wrong because 'verify security nat configuration' is not a valid Junos command. Option D is wrong because 'check nat rules' is not a valid Junos command.

Only 'commit check' is a real Junos command that performs configuration validation.

Practice this question →

10

MCQmedium

An administrator configures destination NAT to publish an internal application server. External users report that connections to the public address fail, but the NAT rule and security policy appear correct. While troubleshooting, the administrator notices that the return traffic from the server is being routed through a different interface than the one on which the original request arrived. What is the most likely cause of the failure?

A.Asymmetric routing causes return traffic to bypass the SRX, so the session is not matched and the connection fails.

B.The destination NAT pool has run out of addresses, so new sessions cannot be created.

C.The destination NAT rule is missing a port translation, so return traffic cannot be matched to the session.

D.The security policy is applied after destination NAT, so the policy is evaluating the wrong destination address.

AnswerA

When return traffic takes a different path and does not traverse the SRX, the device cannot match it to the existing session. The SRX is a stateful device and expects to see both directions of the flow. Asymmetric routing therefore breaks the session and causes the connection to fail.

Why this answer

The SRX is a stateful firewall and must see both directions of a flow to maintain the session. If return traffic is routed around the device, the session cannot be matched and the connection fails. The described symptom of return traffic using a different interface is a classic sign of asymmetric routing, which must be corrected by ensuring symmetric path selection.

Exam trap

The trap here is focusing on NAT rule details when the actual problem is that return traffic bypasses the stateful device due to asymmetric routing.

Practice this question →

11

MCQeasy

Which Junos configuration hierarchy is used to define Destination NAT rule-sets?

A.set security policies destination-nat

B.set security nat destination rule-set

C.set security nat rule-set destination

D.set security nat-policy destination

AnswerB

Destination NAT rule-sets are defined under the security nat destination hierarchy, where rule-set names, match conditions and then destination-nat translations are configured. This hierarchy applies to inbound traffic whose original destination address is being translated.

Why this answer

Destination NAT rule-sets are defined under the 'security nat destination' hierarchy. The correct syntax is 'set security nat destination rule-set <name>'. This hierarchy allows configuration of rules that translate the destination IP address and/or port of incoming packets.

Exam trap

JNCIA-SEC often tests the exact configuration hierarchy for NAT, and candidates may confuse the order of keywords (e.g., 'destination rule-set' vs. 'rule-set destination'). The trap is not memorizing the correct syntax, leading to invalid commands.

How to eliminate wrong answers

Option A is wrong because 'security policies destination-nat' is not a valid hierarchy; destination NAT is configured under 'security nat', not 'security policies'. Option C is wrong because the hierarchy is 'security nat destination rule-set', not 'security nat rule-set destination'. Option D is wrong because 'security nat-policy destination' is not a valid hierarchy; NAT policies are not configured this way in Junos.

Practice this question →

12

MCQhard

A network engineer implements pool-based Source NAT with Port Address Translation (PAT) on a Junos OS device using a pool containing a single public IP address. After deployment, users in the trust zone experience intermittent failures when opening numerous concurrent browser tabs to various internet sites. 'show security flow session' reveals many sessions in a closing state. What is the root cause?

A.The security policy action is set to permit instead of translating, causing port reuse collisions.

B.Port exhaustion has occurred because all available source ports for the single translation IP are in use.

C.The source NAT pool lacks the 'port-overloading' statement, causing the device to drop excess traffic.

D.Junos OS requires an explicit maximum-sessions limit per pool address to prevent CPU overload.

AnswerB

With a single translation address, PAT is limited to roughly 64,000 source ports; heavy concurrent tab usage exhausts them, so new sessions cannot be translated and stall in closing state, producing the intermittent failures described.

Why this answer

With pool-based Source NAT using PAT, all sessions from the trust zone are translated to the single public IP in the pool, and each session consumes a unique source port from that IP. When concurrent sessions exceed the available port range (approximately 64,000 minus reserved ports), new sessions cannot be allocated a translation port, causing intermittent failures and sessions stuck in a closing state as they age out.

Exam trap

JNCIA-SEC often tests the misconception that PAT requires an explicit configuration statement to enable port overloading, when in fact port overloading is automatic with a single-address pool and the real issue is port exhaustion.

How to eliminate wrong answers

Option A is wrong because the security policy action (permit/deny) is independent of NAT translation; NAT is applied via source NAT rules, not the policy action, and 'permit' does not cause port reuse collisions. Option C is wrong because port-overloading (PAT) is the default behavior when a source NAT pool is configured with a single address; there is no 'port-overloading' statement required, and the device does not drop traffic for lack of it. Option D is wrong because Junos does not require an explicit maximum-sessions limit per pool address; the limit is inherent to the port range, and CPU overload is not the described symptom.

Practice this question →

13

Multi-Selecthard

You are auditing a Junos security deployment where multiple NAT types (Destination, Source, Static) and security policies are configured. Which THREE troubleshooting actions or tools should be used to isolate NAT translation failures? (Choose three)

Select 3 answers

A.Use 'request system factory-default' to clear NAT errors.

B.Use 'clear route table inet.0' to reset all IP forwarding paths during NAT lookup failures.

C.Enable security flow traceoptions to log detailed packet matching and NAT translation execution steps.

D.Use 'show security nat rule-set' to verify rule hit counts and ensure matching traffic hits the expected rules.

E.Use 'show security flow session' to inspect pre-NAT and post-NAT IP addresses and ports.

AnswersC, D, E

Flow traceoptions record each packet's path through the security flow module, showing exactly which NAT rule-set and rule matched and where translation failed. This granular logging isolates failures across destination, source and static NAT in a complex deployment.

Why this answer

Option C is correct because security flow traceoptions (configured under [edit security flow traceoptions] with flags such as basic-datapath, packet-drops, and nat) log the detailed packet-matching and NAT translation steps, which is the most granular way to see exactly where a NAT lookup or rule match fails. Option D is correct because 'show security nat rule-set' displays each rule-set and rule with hit counters, letting you confirm whether the traffic is actually matching the intended destination, source, or static NAT rule rather than falling through to another rule or no rule. Option E is correct because 'show security flow session' reveals the pre-NAT and post-NAT addresses and ports (and the NAT translation type) for established sessions, which quickly shows whether translation occurred and how it was applied.

Option A is not appropriate because 'request system factory-default' resets the entire device to factory configuration, destroying the NAT and policy configuration instead of diagnosing it. Option B is not appropriate because 'clear route table inet.0' flushes the IPv4 forwarding table, which disrupts traffic and does not address NAT rule matching or translation logic.

Exam trap

The trap is choosing destructive or unrelated commands (factory-default, clear route table) as 'troubleshooting' steps instead of the non-disruptive verification tools that actually expose NAT behavior.

Practice this question →

14

Multi-Selectmedium

Which TWO operational tasks can be performed using Junos traceoptions for security flow and NAT troubleshooting? (Choose two)

Select 2 answers

A.Flashing system BIOS firmware during bootup.

B.Tracing packet evaluation through NAT rule-sets and translation stages.

C.Debugging session creation, route lookups, and security policy matches.

D.Modifying active configuration syntax dynamically during live debugging.

E.Resetting administrator password credentials.

AnswersB, C

Junos traceoptions can log packet evaluation through NAT rule-sets and translation stages, exposing which rule matched and how addresses were translated. This directly satisfies the stem's requirement for NAT troubleshooting, since the flow trace records the decision path rather than only counters or session summaries.

Why this answer

Option B is correct because Junos traceoptions for security flow can log how packets are evaluated against NAT rule-sets, including which rule matches and the resulting translation (source/destination NAT) applied at each stage. Option C is correct because security flow traceoptions capture session creation and teardown, route lookups, and security policy match decisions, which are exactly the events needed to debug flow and policy behavior. Options A, D, and E are not related to traceoptions: flashing BIOS firmware is a hardware/boot task, modifying configuration syntax is done via configuration mode (not traceoptions), and resetting administrator credentials is a recovery/authentication operation, not a flow/NAT debugging function.

Exam trap

JNCIA-SEC often tests the scope of traceoptions; candidates may incorrectly think traceoptions can modify configurations or perform hardware tasks, confusing it with other operational commands.

Practice this question →

15

MCQmedium

You are configuring a Juniper SRX Series device for a new web server farm that must be reachable from the Internet on port 443. The servers sit behind the device on the 10.10.10.0/24 subnet, and the public address is 203.0.113.50. You want to translate only incoming HTTPS traffic to the internal server at 10.10.10.20 while leaving other inbound traffic unaffected. Which type of NAT should you configure?

A.Static NAT mapping 203.0.113.50 to 10.10.10.20, without any port restriction.

B.Persistent NAT with a pool containing 203.0.113.50 and a port range of 443.

C.Source NAT with a pool containing 10.10.10.20, applied to the untrust zone.

D.Destination NAT with a rule matching destination address 203.0.113.50 and destination port 443, translating to 10.10.10.20.

AnswerD

Destination NAT on Junos is designed for exactly this purpose: it rewrites the destination IP and optionally the destination port for inbound sessions. Matching the public address and port 443 and translating to the internal server address satisfies the requirement without affecting other traffic, because only sessions that match the rule are translated.

Why this answer

Publishing an internal server to the Internet on a specific port requires destination NAT, which rewrites the destination address and port of inbound sessions. The rule matches the public address and the service port, then translates to the internal server address. Source and static NAT do not provide the same selective, port-based inbound translation behavior.

Exam trap

The trap here is assuming that static NAT is required to publish an internal server, when destination NAT with a port match is the correct tool for selective inbound service translation.

Practice this question →

16

MCQhard

You are troubleshooting a scenario where an SRX device is performing Static NAT. An internal server initiates outbound connections to the internet. When external recipients examine the packets, they see the correct static NAT public IP as the source. However, when the external recipients reply, the packets are dropped by the SRX. Traceoptions reveal 'No session found for packet'. What is the cause of this session lookup failure?

A.The return traffic security policy or session state lookup failed because the incoming return packet did not match the expected session parameters or was blocked by a policy.

B.The routing table lacks a default route for static NAT reply packets.

C.Static NAT requires explicit source NAT pool definitions for all outbound connections.

D.Proxy ARP is not enabled for the internal server's private IP address.

AnswerA

Static NAT alone does not create a session; the returning packet must match an existing session or be permitted by policy. The 'No session found' trace means the reply failed that lookup, so the SRX dropped it before any translation occurred.

Why this answer

The SRX drops return packets with 'No session found for packet' because the return traffic does not match an existing session. For Static NAT, the SRX creates a session when the internal host initiates outbound traffic, but the return packet must match the expected source/destination IP and port. If the return packet is blocked by a security policy or does not match the session parameters (e.g., due to asymmetric routing or policy misconfiguration), the SRX drops it.

Option A correctly identifies that the return traffic security policy or session state lookup failed.

Exam trap

JNCIA-SEC often tests the misconception that Static NAT automatically handles return traffic without requiring a security policy or session match, when in fact the SRX still enforces session-based forwarding and policy checks.

How to eliminate wrong answers

Option B is wrong because a default route is not required for return traffic if the SRX already has a route to the internal server; the issue is session lookup, not routing. Option C is wrong because Static NAT does not require source NAT pool definitions; it uses a one-to-one mapping. Option D is wrong because Proxy ARP is used for inbound connections to the NAT IP, not for outbound-initiated sessions; the external recipients already see the correct public IP, so ARP is not the issue.

Practice this question →

17

MCQhard

You are troubleshooting a production SRX device where a Source NAT pool is shared across multiple security zones. Users in Zone A report normal internet access, but users in Zone B experience immediate session drops. Reviewing the source NAT rule-set shows that rule ordering places a generic Zone B rule below a restrictive Zone A rule that blocks or limits specific source IPs. What is the best practice to resolve NAT rule evaluation issues in multi-zone rule-sets?

A.Reorder the rules within the rule-set so that more specific matching criteria appear before broader or restrictive rules, or use separate rule-sets per zone.

B.Convert all source NAT rules to interface-based NAT to bypass pool evaluation errors.

C.Enable global zone-bypass mode for all source NAT pools.

D.Merge all zones into a single security zone to eliminate rule-set evaluation discrepancies.

AnswerA

Junos evaluates NAT rules top-down, first match wins, so a broad Zone B rule placed beneath a restrictive Zone A rule never triggers for affected sources. Moving specific criteria above broader entries, or splitting rule-sets per zone, restores correct evaluation and clears the session drops.

Why this answer

In Juniper SRX source NAT, rules within a rule-set are evaluated top-down and the first match wins, so a broad or restrictive rule placed above a more specific rule will shadow it. The fix is to order rules from most specific to least specific, or to split rules into separate rule-sets per zone so that Zone A's restrictive rules cannot interfere with Zone B's traffic. This restores correct pool selection and prevents the session drops Zone B is experiencing.

Exam trap

JNCIA-SEC often tests the misconception that SRX NAT rules behave like firewall policies with implicit specificity ordering — in reality, first-match-wins applies, so a broad rule above a specific one silently shadows it.

How to eliminate wrong answers

Option B is wrong because interface-based NAT does not bypass rule evaluation — it is simply a different NAT style, and converting to it does not fix ordering problems and may break pool-based address translation requirements. Option C is wrong because there is no such feature as 'global zone-bypass mode' for source NAT pools on SRX; this is a fabricated option. Option D is wrong because merging security zones collapses your security policy boundaries and is a serious architectural regression, not a NAT troubleshooting fix.

Practice this question →

18

MCQmedium

An administrator configures a Source NAT pool containing a single public IP address. Multiple internal users browse the web simultaneously. How does Junos OS distinguish between simultaneous sessions originating from different internal private IP addresses destined for the same external web server on port 80?

A.By translating each internal source IP and ephemeral port combination into a unique source port on the single public IP address (PAT).

B.By modifying the destination port to a unique value for each internal user session.

C.By assigning virtual MAC addresses to each session in the ARP table.

D.By queuing sessions and processing them sequentially through the single IP address.

AnswerA

Port address translation multiplexes sessions by rewriting each internal source IP and ephemeral port into a unique source port on the single public address. This uniqueness lets Junos OS distinguish simultaneous sessions from different internal users to the same external server on port 80.

Why this answer

When a source NAT pool has a single public IP, Junos uses Port Address Translation (PAT) — also called NAT overload — to multiplex multiple internal sessions onto that one IP. Each internal source IP and ephemeral port combination is translated to a unique source port on the public IP, so the SRX can distinguish sessions by the (public IP, source port) tuple and reverse the translation correctly for return traffic.

Exam trap

JNCIA-SEC often tests whether candidates confuse PAT (source port multiplexing) with other translation mechanisms, or mistakenly think destination ports or MAC addresses are used to distinguish sessions.

How to eliminate wrong answers

Option B is wrong because modifying the destination port would break the client's connection to the web server on port 80 — destination ports are not altered by source NAT. Option C is wrong because virtual MAC addresses are a layer-2 concept used for redundancy (VRRP) or proxy ARP, not for distinguishing NAT sessions. Option D is wrong because queuing sessions sequentially would serialize traffic and destroy performance; Junos handles sessions concurrently via the flow table, not by serialization.

Practice this question →

19

MCQeasy

An administrator wants to configure static NAT on an SRX Series device to map the public IP address 203.0.113.5 to the internal server 192.168.1.5. Which configuration statement correctly accomplishes this?

A.set security nat source rule-set rs1 rule r1 match source-address 192.168.1.5; set security nat source rule-set rs1 rule r1 then source-nat interface

B.set security nat static rule-set rs1 rule r1 then static-nat prefix 192.168.1.5

C.set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.5; set security nat static rule-set rs1 rule r1 then static-nat prefix 192.168.1.5

D.set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.5

AnswerC

This configuration includes both the match condition for the public IP and the then action to translate to the internal IP. Together, they form a complete static NAT rule that maps 203.0.113.5 to 192.168.1.5. This is the correct syntax for static NAT on Junos OS.

Why this answer

Static NAT requires a rule with a match condition for the public IP and a then action specifying the internal IP. The correct configuration includes both the destination-address match and the static-nat prefix action. The other options are incomplete or use source NAT, which is not appropriate for inbound static mapping.

Exam trap

The trap here is selecting a configuration that only includes either the match or the then statement, or confusing source NAT with static NAT.

Practice this question →

20

MCQhard

You are analyzing security flow traceoptions while troubleshooting a failing Source NAT scenario. The trace output indicates: 'NAT error: no available ports in pool'. However, a concurrent check of the pool using operational commands shows that only a fraction of the pool's IP addresses are currently utilized. What is the cause of this behavior?

A.Interface-based NAT is overriding the pool-based NAT configuration due to a rule-set ordering conflict.

B.The SRX device has reached its maximum global session limit across all security contexts.

C.The source IP has exhausted the port allocation on its assigned pool address, and port sharing across multiple pool IPs is not enabled.

D.Proxy ARP is blocking additional port allocation from the upstream gateway.

AnswerC

Source NAT allocates ports per translated pool address; once that single address's port range is exhausted, new sessions fail even though other pool IPs remain idle. Enabling port sharing across pool addresses would spread allocations and resolve the error.

Why this answer

The error 'no available ports in pool' means the SRX has exhausted the ephemeral port range on the specific pool IP address currently assigned to that source. Junos source NAT with interface or pool-based translation allocates ports per pool address; if port sharing across multiple pool IPs is not enabled (or the source is pinned to one address), the device will not spill over to other underutilized IPs in the pool. Enabling port sharing or using address-persistent/round-robin allocation allows the SRX to distribute sessions across all pool addresses.

Exam trap

JNCIA-SEC often tests whether candidates assume a pool-wide exhaustion when the error actually refers to a single pool IP's port range being exhausted due to address-persistent or non-shared allocation.

How to eliminate wrong answers

Option A is wrong because interface-based NAT overriding pool-based NAT would produce a different error (translation mismatch or rule not matched), not a port exhaustion message, and rule-set ordering conflicts do not manifest as 'no available ports'. Option B is wrong because a global session limit would produce a 'session limit exceeded' or 'flow resource unavailable' error, not a pool port exhaustion error, and it would affect all NAT pools, not just one. Option D is wrong because Proxy ARP operates at layer 2/3 for address resolution and has no role in port allocation within a NAT pool.

Practice this question →

21

MCQeasy

An administrator is troubleshooting why an internal host cannot reach an external server after a source NAT configuration change. The host's traffic is being translated, but the return traffic is not being forwarded back to the host. Which component should the administrator verify first to ensure return traffic is handled correctly?

A.The NAT pool address range, to verify that it overlaps with the internal subnet.

B.The security policy that permits the outbound session, to confirm that it also allows return traffic.

C.The proxy ARP configuration on the internal interface, to ensure the host can resolve the gateway.

D.The session table, to confirm that a session exists and that the reverse translation is installed.

AnswerD

The session table shows whether a session was created and whether NAT translations, including the reverse mapping, are present. If the reverse translation is missing or incorrect, return traffic cannot be properly rewritten and forwarded, which directly matches the symptom of outbound translation working but return traffic failing.

Why this answer

When outbound traffic is translated but return traffic fails, the most direct check is the session table. It reveals whether the session was created and whether the reverse NAT translation is correctly installed. Without the reverse mapping, the device cannot rewrite the destination address back to the internal host, and return packets are dropped or misrouted.

Exam trap

The trap here is assuming that a separate security policy is needed for return traffic, when Junos security policies are stateful and the session table is the authoritative source for translation state.

Practice this question →

22

MCQhard

You are troubleshooting a high-throughput SRX deployment using Pool-based Source NAT with PAT. Users report random connection drops during peak business hours. You run 'show security nat pool' and see that pool utilization is low, but traceoptions show 'resource allocation failure: port limit exceeded'. What is the most precise explanation for this condition?

A.Individual source IP port limits have been reached on the assigned pool address, requiring port-sharing or dynamic allocation adjustments.

B.Proxy ARP is rate-limiting the ARP reply frequency for source NAT public IPs.

C.The SRX control plane CPU is throttling NAT session creation due to security policy evaluation lag.

D.Destination NAT rules are consuming source NAT pool ports.

AnswerA

PAT multiplexes sessions through ports on the translated address. Even with pool addresses free, a single source IP exhausting its allocatable port range triggers 'port limit exceeded', so enabling port-sharing or dynamic allocation resolves the drops.

Why this answer

The error 'resource allocation failure: port limit exceeded' indicates that the individual source IP port limits have been reached on the assigned pool address. Even though pool utilization is low, a single IP in the pool may have exhausted its available ports, requiring port-sharing or dynamic allocation adjustments. This is a common issue in high-throughput NAT scenarios.

Exam trap

JNCIA-SEC often tests the confusion between pool utilization (number of IPs used) and port exhaustion on individual IPs, leading candidates to overlook port limits.

How to eliminate wrong answers

Option B is wrong because Proxy ARP rate-limiting would not cause port limit errors; it would affect ARP resolution. Option C is wrong because control plane CPU throttling would not produce a port limit exceeded message; it would show CPU-related errors. Option D is wrong because Destination NAT rules do not consume source NAT pool ports; they use separate resources.

Practice this question →

23

MCQeasy

Which Junos configuration statement defines a static NAT rule mapping the public IP 203.0.113.5 to the internal private IP 192.168.1.5?

A.set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.5/32 then static-nat prefix 192.168.1.5/32

B.set security nat static pool p1 public 203.0.113.5 private 192.168.1.5

C.set security nat destination rule-set rs1 rule r1 match source-address 203.0.113.5 then static-nat 192.168.1.5

D.set security nat source static-map public 203.0.113.5 internal 192.168.1.5

AnswerA

Static NAT uses match destination-address to identify the public address and then static-nat prefix to specify the internal address it maps to. This one-to-one binding satisfies the requirement of mapping 203.0.113.5 to 192.168.1.5 within a rule-set.

Why this answer

The correct Junos syntax for static NAT is 'set security nat static rule-set <name> rule <name> match destination-address <public-ip>/32 then static-nat prefix <private-ip>/32'. This maps the public IP 203.0.113.5 to the internal 192.168.1.5 using the static NAT rule-set structure, which is the only valid syntax among the options.

Exam trap

JNCIA-SEC often tests whether candidates confuse static NAT syntax with source NAT pool syntax, or reverse the match direction (using source-address instead of destination-address) in static NAT rules.

How to eliminate wrong answers

Option B is wrong because 'security nat static pool' is not valid Junos syntax — static NAT does not use pools; pools are used for source NAT. Option C is wrong because it uses 'security nat destination' with 'source-address' as the match condition, which is backwards for static NAT and uses the wrong hierarchy (destination NAT is for port/address translation of inbound traffic, not static 1:1 mapping). Option D is wrong because 'security nat source static-map' is not valid Junos syntax — source NAT uses pools and rule-sets, not static-map.

Practice this question →

24

MCQmedium

An administrator is troubleshooting a NAT issue on an SRX Series device and wants to view active NAT sessions to verify whether source translation is happening. Which operational command should be used?

A.show security nat translation summary

B.show system nat active-translations

C.show route forwarding-table destination nat

D.show security flow session

AnswerD

show security flow session displays active sessions with their translation details, letting the administrator confirm whether source NAT is applied. It satisfies the stem's requirement for an operational command to verify source translation, unlike pool or rule-set commands that show configuration rather than live sessions.

Why this answer

The command 'show security flow session' displays active flow sessions on the SRX, including source and destination addresses, ports, and NAT translations. It is the primary operational command to verify whether source NAT is being applied and to inspect session state. Administrators use it to confirm that a session exists and that the translated address/port is correct.

Exam trap

The trap is choosing a command that sounds plausible but does not exist in Junos; candidates must know the exact operational command syntax for viewing NAT sessions.

How to eliminate wrong answers

Option A is wrong because 'show security nat translation summary' is not a valid Junos command; NAT statistics are viewed via 'show security nat source summary' or similar. Option B is wrong because 'show system nat active-translations' does not exist in Junos. Option C is wrong because 'show route forwarding-table destination nat' is not a NAT session command; it relates to routing table lookups.

Practice this question →

25

MCQmedium

An SRX Series device performs destination NAT for an internal web server. The public address is 198.51.100.80 and the private address is 10.10.10.80. External users can reach the server, but the server's replies are being translated back correctly only when the original destination port is preserved. The administrator must ensure that the destination NAT rule matches traffic destined to 198.51.100.80 on TCP port 8080 and translates it to 10.10.10.80 on TCP port 80. Which configuration statement correctly accomplishes this?

A.set security nat destination rule-set rs1 rule r1 match destination-address 198.51.100.80/32

B.set security nat destination rule-set rs1 rule r1 match destination-address 10.10.10.80/32 destination-port 8080

C.set security nat destination rule-set rs1 rule r1 match destination-address 198.51.100.80/32 destination-port 8080

D.set security nat destination rule-set rs1 rule r1 match destination-address 198.51.100.80/32 destination-port 80

AnswerC

This statement matches traffic destined to 198.51.100.80 on TCP port 8080, which is exactly the match condition required before the translation. When combined with a then destination-nat pool or static mapping that translates to 10.10.10.80 port 80, the rule will correctly redirect the traffic. The destination-port match is essential because the public port differs from the private port in this scenario.

Why this answer

The rule must match the public destination address and the public port before translation. Matching 198.51.100.80 on destination-port 8080 identifies the correct inbound flow. The translation action, configured separately, then rewrites the destination to 10.10.10.80 port 80.

Matching the private address or the wrong port would cause the rule not to trigger for the intended traffic.

Exam trap

The trap here is confusing the public-facing port with the internal service port when writing the match condition for destination NAT.

Practice this question →

26

Multi-Selecteasy

Which TWO statements describe the purpose of NAT on Juniper Networks SRX Series devices? (Choose two)

Select 2 answers

A.Replacing the function of internal routing protocols like OSPF and BGP.

B.Providing mandatory encryption for all packet payloads traversing security zones.

C.Eliminating the need for security policies on the SRX device.

D.Allowing internal private networks to communicate with external public networks.

E.Conserving public IPv4 address space by allowing private internal hosts to share public IP addresses.

AnswersD, E

NAT translates private RFC 1918 addresses to routable public addresses at the SRX boundary, satisfying the stem's requirement that internal hosts reach external networks. Source NAT rewrites the source IP in outbound packets, enabling return traffic through the session table, which is precisely the connectivity purpose described.

Why this answer

Option D is correct because NAT on SRX Series devices translates private RFC 1918 source addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) into routable public addresses, enabling internal hosts to reach external networks such as the Internet. Option E is correct because source NAT (interface or pool-based) lets many internal hosts share one or a few public IPv4 addresses via PAT/port translation, which conserves the limited public IPv4 address space. Option A is wrong because NAT is a translation function, not a routing protocol, and does not replace OSPF or BGP.

Option B is wrong because NAT performs address/port translation, not encryption; that is the role of IPsec or other VPN technologies. Option C is wrong because SRX security policies still control traffic flow between zones regardless of NAT, and NAT alone does not permit or deny traffic.

Exam trap

JNCIA-SEC often tests the misconception that NAT provides security or replaces security policies, when in fact NAT is an address translation mechanism and security policies are still mandatory on SRX.

Practice this question →

27

MCQhard

A network engineer is configuring a source NAT pool on an SRX Series device. The pool contains two IP addresses: 198.51.100.1 and 198.51.100.2. The engineer wants to ensure that a single internal host always uses the same public IP address for the duration of its session, but different hosts can use different public IPs. Which allocation method should be used?

A.no-translation

B.paired

C.round-robin

D.address-persistent

AnswerD

The address-persistent allocation method ensures that a given internal host is mapped to the same public IP address for all its sessions as long as the mapping remains in the NAT table. This provides session persistence per host, which is useful when external services expect a consistent source IP. It does not guarantee a fixed mapping permanently, but it meets the requirement of consistent public IP per host during active sessions.

Why this answer

The address-persistent allocation method ensures that a specific internal host consistently uses the same public IP address from the pool for its sessions. This provides the desired per-host consistency while still allowing multiple hosts to share the pool. Round-robin would distribute sessions randomly, and paired is for static mappings.

Therefore, address-persistent is the correct choice.

Exam trap

The trap here is confusing address-persistent with round-robin; address-persistent ties a host to one public IP, while round-robin spreads sessions across all pool addresses.

Practice this question →

28

MCQeasy

Which command is used to clear active NAT sessions on an SRX Series device during troubleshooting?

A.reset security nat sessions

B.clear route forwarding-table nat

C.clear security nat translation cache

D.clear security flow session

AnswerD

The clear security flow session command removes active sessions from the flow table, forcing NAT sessions to be re-established. This satisfies the troubleshooting requirement by flushing stale translations so traffic is re-evaluated against current NAT rule-sets.

Why this answer

On Juniper SRX Series devices, active NAT sessions are stored in the flow session table, and the correct command to clear them is 'clear security flow session'. This command removes the session entries, forcing traffic to re-establish sessions and re-evaluate NAT and security policies. It is the standard troubleshooting step when stale NAT translations cause connectivity issues.

Exam trap

The trap is that candidates assume NAT sessions are stored separately from flow sessions, leading them to look for a NAT-specific clear command; in Junos, NAT state is part of the flow session, so the correct command is the flow session clear.

How to eliminate wrong answers

Option A is wrong because 'reset security nat sessions' is not a valid Junos command; the 'reset' verb is used for other purposes (e.g., resetting interfaces) and does not clear NAT sessions. Option B is wrong because 'clear route forwarding-table nat' is not a valid command — the forwarding table does not store NAT sessions, and this syntax does not exist in Junos. Option C is wrong because 'clear security nat translation cache' is not a valid Junos command; while some platforms have NAT caches, SRX does not use this syntax to clear active sessions.

Practice this question →

29

MCQmedium

An administrator configures interface-based Source NAT on the outgoing external interface of a SRX Series device. However, internal hosts report being unable to reach external web servers. Upon checking the security flow session, the administrator notices that packets are egressing the interface with the actual internal private IP address rather than the interface IP. What is the most likely cause?

A.The security policy is evaluating the post-translation source IP instead of the pre-translation IP.

B.Proxy ARP must be manually enabled on the internal interface for interface-based NAT to function.

C.Interface-based Source NAT requires an explicit routing instance to bypass the master routing table.

D.The source NAT rule is missing the 'then source-nat interface' action statement.

AnswerD

Interface-based source NAT requires the 'then source-nat interface' action to translate the source address to the egress interface IP. Without it, the rule matches but performs no translation, so packets leave with the original private address, matching the observed symptom.

Why this answer

Interface-based Source NAT on a Juniper SRX requires the explicit action statement 'then source-nat interface' within the NAT rule. Without this action, the NAT rule matches traffic but performs no translation, so packets egress with their original private source IP, causing return traffic to fail. The security flow session showing the internal IP confirms the NAT action is missing.

Exam trap

JNCIA-SEC often tests the misconception that simply creating a NAT rule-set with match conditions is sufficient, when in fact the explicit 'then source-nat interface' action statement is mandatory for interface-based source NAT to function.

How to eliminate wrong answers

Option A is wrong because SRX security policies evaluate the pre-translation (original) source IP by default, not the post-translation IP — this is expected behavior and not the cause of the failure. Option B is wrong because proxy ARP is not required for interface-based source NAT on the egress interface; it is relevant for destination NAT scenarios where the SRX must answer ARP for a translated address. Option C is wrong because interface-based source NAT operates in the master routing table and does not require a separate routing instance; routing instances are used for virtual routers or VRF-like separation, not for basic NAT.

Practice this question →

30

MCQhard

You are troubleshooting a Junos security device where a Destination NAT rule is configured. External users reach the virtual IP, but traffic fails to establish a TCP 3-way handshake. Using 'monitor traffic', you observe SYN packets arriving at the external interface and leaving the internal interface towards the server. However, no SYN-ACK packets return from the server. What is the most likely networking or routing reason on the internal network causing this?

A.The security policy is evaluating pre-translation source ports instead of post-translation source ports.

B.Proxy ARP is disabled on the internal interface of the SRX.

C.The internal server's default gateway does not point to the SRX device, causing asymmetric routing where return packets bypass the firewall.

D.The destination NAT rule is missing the port translation statement, causing the server to drop unrecognized ports.

AnswerC

If the server's default gateway is not the SRX, its SYN-ACK is routed elsewhere, bypassing the firewall's session table. The SRX never sees the reply, so the TCP handshake cannot complete, matching the observed one-way traffic.

Why this answer

If SYN packets reach the internal server but no SYN-ACK returns, the server is likely sending its response to a different next-hop — typically its default gateway is not the SRX, so return traffic bypasses the firewall and the session never completes. This is classic asymmetric routing: the SRX sees only one direction of the flow, so it cannot establish the session or perform the reverse NAT translation. The fix is to point the server's default gateway to the SRX internal interface.

Exam trap

JNCIA-SEC often tests whether candidates blame the firewall (policy, NAT, Proxy ARP) when the actual issue is a routing asymmetry on the internal network — the server's default gateway not pointing to the SRX.

How to eliminate wrong answers

Option A is wrong because security policy evaluation of pre- vs post-translation ports would cause a policy drop (visible as a deny in the flow trace), not a missing SYN-ACK from the server — the server would still respond if it received the SYN. Option B is wrong because Proxy ARP on the internal interface affects address resolution for the NAT pool, not the return path of an established TCP handshake; disabling it would prevent ARP resolution, not cause silent SYN-ACK loss. Option D is wrong because missing port translation would cause the server to receive traffic on an unexpected port and likely send a TCP RST (not silence), and the question states SYN packets are leaving toward the server correctly.

Practice this question →

31

Multi-Selecteasy

Which TWO statements are true regarding Interface-based Source NAT in Junos OS? (Choose two)

Select 2 answers

A.It is configured using the 'then source-nat interface' statement in a source NAT rule.

B.It is evaluated before Destination NAT in the Junos processing pipeline.

C.It translates the source IP address to the primary IP address of the egress interface.

D.It requires an explicit address pool containing at least 10 public IP addresses.

E.It requires Proxy ARP configured on all internal interfaces.

AnswersA, C

The 'then source-nat interface' action translates the source address to the egress interface's address, satisfying interface-based source NAT. It is applied within a source NAT rule, letting the firewall use the outbound interface IP rather than a configured pool.

Why this answer

Option A is correct because Interface-based Source NAT in Junos OS is indeed configured by adding the 'then source-nat interface' action to a source NAT rule, which tells the device to use the egress interface's address for translation. Option C is correct because this NAT type translates the original source IP address to the primary IP address of the outbound (egress) interface, which is the defining behavior of interface-based source NAT. Option B is incorrect because in the Junos NAT processing order, Destination NAT is evaluated before Source NAT, not after.

Option D is incorrect because interface-based source NAT does not use an address pool at all; it uses the interface address, so no pool of 10 public IPs is required. Option E is incorrect because Proxy ARP is not a requirement for interface-based source NAT; it is typically used in other NAT or routing scenarios and is not mandated here.

Exam trap

JNCIA-SEC often tests the order of NAT processing, confusing candidates into thinking Source NAT is evaluated before Destination NAT, when the reverse is true.

Practice this question →

32

MCQmedium

An administrator configures Source NAT with a pool. Users can access external websites, but traceroute packets originating from internal hosts towards external destinations fail to display intermediate router hops. What is the most common reason traceroute fails through certain Junos Source NAT / PAT implementations?

A.Proxy ARP intercepts ICMP TTL expiry messages on the egress interface.

B.ICMP Time Exceeded error packets returning from routers do not always map back to the PAT session state or are blocked by security policies.

C.Source NAT pools inherently disable ICMP protocol support globally.

D.Traceroute packets require Static NAT to function across security firewalls.

AnswerB

PAT rewrites the source port, so returning ICMP Time Exceeded packets from intermediate routers carry no matching port mapping and cannot be associated with the original traceroute session. Security policies may also drop them, which is why intermediate hops never display.

Why this answer

Traceroute relies on ICMP Time Exceeded messages generated by intermediate routers when TTL expires. With PAT, the returning ICMP error must be mapped back to the original session; if the SRX cannot correlate the ICMP payload to an existing PAT session, or if security policy blocks the ICMP error, the traceroute output shows no intermediate hops. This is the most common reason traceroute fails through PAT.

Exam trap

The trap is assuming traceroute failure is due to a NAT type limitation (e.g., needing static NAT) rather than the more subtle issue of ICMP error mapping and policy handling in PAT.

How to eliminate wrong answers

Option A is wrong because proxy ARP deals with ARP resolution, not ICMP TTL expiry interception; it does not block traceroute responses. Option C is wrong because source NAT pools do not globally disable ICMP; ICMP can still be translated and forwarded. Option D is wrong because traceroute does not require static NAT; it works through PAT when ICMP errors are properly handled.

Practice this question →

33

MCQmedium

An administrator configures a Source NAT rule with an address pool. When verifying traffic, the administrator notices that multiple distinct internal subnets are matching the rule. How can the administrator restrict the source NAT rule to apply only to a specific subnet while leaving other subnets un-translated?

A.Specify an exact prefix under the rule's 'match source-address' statement.

B.Apply a firewall filter on the ingress interface to drop un-translated subnets.

C.Configure static routes for un-translated subnets pointing to the loopback interface.

D.Configure the rule-set source zone with individual interface subnets.

AnswerA

Source NAT rules match on the source-address field, so narrowing that statement to the exact prefix limits translation to that subnet alone. Broader subnets then fall through unmatched and remain untranslated, satisfying the requirement to leave other subnets untouched.

Why this answer

The correct way to restrict a source NAT rule to a specific subnet is to specify an exact prefix under the rule's 'match source-address' statement. This directly limits the rule to only match traffic from that subnet, leaving other subnets unmatched and therefore untranslated. This is the standard Junos NAT configuration approach.

Exam trap

JNCIA-SEC often tests the misconception that zone or interface configuration alone can restrict NAT scope, when in fact the match source-address statement is the precise tool for subnet-level filtering.

How to eliminate wrong answers

Option B is wrong because a firewall filter on the ingress interface would drop traffic from other subnets, not simply leave them untranslated; it would disrupt connectivity. Option C is wrong because static routes pointing to the loopback interface would blackhole traffic, not selectively exclude it from NAT. Option D is wrong because the source zone in a rule-set defines where traffic originates, but does not restrict NAT to a specific subnet; multiple subnets can exist in the same zone.

Practice this question →

34

MCQhard

You are troubleshooting a Junos security device where a Static NAT rule is configured for an internal server. Internal users access the server using its public IP address. You notice that traffic from internal clients hitting the static NAT IP creates asymmetric routing or fails because source translation is absent. How does Junos handle internal clients accessing a server via its static NAT public IP without explicit hairpin NAT?

A.Without hairpin source NAT, the internal server responds directly to the internal client, causing the client to drop the packet due to mismatched source/destination IP states.

B.Static NAT automatically applies hairpin source NAT when source and destination zones are identical.

C.Proxy ARP automatically intercepts internal static NAT requests and rewrites the source IP.

D.Junos automatically converts internal static NAT requests into loopback tunnel traffic.

AnswerA

Junos performs destination NAT on the inbound packet, translating the public IP to the server's private address, but leaves the client's source address unchanged. The server replies directly to the internal client, whose session expects traffic from the NAT IP, so the mismatched source causes the client to drop the packet.

Why this answer

When an internal client accesses an internal server via its static NAT public IP, the packet is translated to the server's private IP, but the source IP remains the client's private IP. The server responds directly to the client's private IP, bypassing the Junos device. The client, expecting the response from the public IP it originally sent the packet to, sees a response from a different source IP and drops the packet due to mismatched session state.

This is why hairpin NAT (source NAT for internal-to-internal traffic) is needed.

Exam trap

JNCIA-SEC often tests the misconception that static NAT automatically handles internal-to-internal traffic via hairpin NAT, when in fact explicit source NAT configuration is required to avoid asymmetric routing and packet drops.

How to eliminate wrong answers

Option B is wrong because static NAT does not automatically apply hairpin source NAT; hairpin NAT must be explicitly configured with a source NAT rule to translate the internal client's source IP to the Junos device's interface IP. Option C is wrong because proxy ARP is used to respond to ARP requests for NAT IPs, not to rewrite source IPs for internal traffic. Option D is wrong because Junos does not automatically convert internal static NAT requests into loopback tunnel traffic; such traffic is handled by normal routing and NAT rules.

Practice this question →

35

Multi-Selectmedium

Which TWO features or settings are associated with troubleshooting or optimizing Port Address Translation (PAT) in Junos OS? (Choose two)

Select 2 answers

A.Persistent NAT configuration for port consistency

B.Configuring static ARP entries for every PAT port

C.Modifying control plane CPU priority for NAT timers

D.Monitoring pool port utilization using 'show security nat pool'

E.Disabling flow-based forwarding globally

AnswersA, D

Persistent NAT preserves the source port mapping across sessions, so return traffic consistently reaches the same internal host. This directly addresses PAT troubleshooting where asymmetric or broken mappings cause failures, and supports optimisation by keeping address-binding entries stable for applications requiring inbound consistency.

Why this answer

Option A is correct because Persistent NAT in Junos OS is a PAT-related feature that keeps the same NAT source port mapping for a given internal host, ensuring port consistency for applications that require stable translations. Option D is correct because the 'show security nat pool' operational command displays PAT pool statistics, including port utilization, which is essential for troubleshooting and optimizing PAT pool exhaustion. Option B is incorrect because static ARP entries are unrelated to PAT port translation and are not required per PAT port.

Option C is incorrect because NAT timers are not tuned by modifying control plane CPU priority. Option E is incorrect because disabling flow-based forwarding globally would break normal Junos security processing and is not a PAT troubleshooting or optimization setting.

Exam trap

JNCIA-SEC often tests the misconception that static ARP or control plane CPU settings are relevant to PAT troubleshooting, when the actual tools are persistent NAT and pool utilization monitoring commands.

Practice this question →

36

MCQhard

You are troubleshooting a scenario where an SRX Series device is performing Destination NAT. You notice that sessions are being created in the flow table, but the translation is failing because the packet hits a rule in a different rule-set. How does Junos OS evaluate multiple Destination NAT rule-sets?

A.All matching rule-sets are applied in parallel, which can cause translation conflicts.

B.Rule-sets are evaluated in the order they appear in the configuration; the first matching rule-set and rule are applied.

C.Rule-sets are evaluated based on the most specific destination IP address match across all rule-sets simultaneously.

D.Destination NAT rule-sets are evaluated alphabetically by rule-set name.

AnswerB

Junos OS evaluates destination NAT rule-sets in configuration order, applying the first matching rule-set and rule. A packet matching an earlier rule-set is translated there, so a later rule-set never processes it, explaining the failure.

Why this answer

Junos OS evaluates destination NAT rule-sets in the order they appear in the configuration (top-down), and within a rule-set, rules are also evaluated top-down. The first rule-set whose match conditions are satisfied applies its translation, and subsequent rule-sets are not evaluated. This deterministic ordering is why rule placement matters — a broad rule placed earlier can shadow a more specific rule placed later.

Exam trap

JNCIA-SEC often tests whether candidates assume most-specific-match or parallel evaluation for NAT rule-sets, when Junos actually uses strict first-match ordering based on configuration sequence.

How to eliminate wrong answers

Option A is wrong because Junos does not apply multiple destination NAT rule-sets in parallel; parallel evaluation would create non-deterministic translation conflicts, which Junos explicitly avoids. Option C is wrong because Junos does not perform longest-prefix or most-specific matching across rule-sets — it uses first-match ordering, so a /24 rule earlier in the config beats a /32 rule later. Option D is wrong because rule-set names are arbitrary labels; evaluation order is based on configuration order, not alphabetical sorting.

Practice this question →

37

MCQmedium

A security administrator is configuring destination NAT on an SRX Series device to publish an internal application server. The public address is 198.51.100.25, and the internal server is 172.16.5.10. The administrator wants the device to answer ARP requests for 198.51.100.25 on the untrust interface so that upstream routers can reach the server. Which configuration statement is required?

A.set interfaces ge-0/0/0 unit 0 family inet address 198.51.100.25/32

B.set security nat proxy-arp interface ge-0/0/0.0 address 198.51.100.25

C.set security nat destination rule-set rs1 rule r1 match destination-address 198.51.100.25

D.set security nat destination pool pub-pool address 198.51.100.25/32

AnswerB

Proxy ARP tells the SRX Series device to answer ARP requests for the specified address on the given interface. This is exactly what is needed so that upstream routers can resolve the public address and forward traffic to the device, which then applies destination NAT to reach the internal server.

Why this answer

For inbound destination NAT to work, upstream devices must be able to resolve the public address to the SRX Series device's MAC address. Proxy ARP achieves this by having the device respond to ARP requests for the translated address on the specified interface, ensuring traffic reaches the device for translation.

Exam trap

The trap here is assuming that configuring the destination NAT rule or pool automatically makes the device respond to ARP for the public address, when proxy ARP must be explicitly enabled.

Practice this question →

38

MCQmedium

An administrator configures a Source NAT rule-set with 'from zone trust' and 'to zone untrust'. Internal users can successfully browse the internet. Later, a new interface and zone (DMZ) are added, and hosts in the DMZ also need Source NAT to the untrust zone using the same pool. What is the most efficient way to achieve this?

A.Enable global NAT mode under the system hierarchy to automatically apply NAT across all zones.

B.Delete the trust zone rule-set and recreate it globally without specifying any source zone.

C.Modify the existing rule-set to include the DMZ zone in the 'from zone' statement, or create an additional rule-set for the DMZ zone.

D.Configure static routes from the DMZ zone directly to the untrust zone to bypass NAT requirements.

AnswerC

Adding the DMZ zone to the existing rule-set's from zone statement reuses the same pool and rule-set, avoiding duplication. This satisfies the stem's requirement for the most efficient approach, since a separate rule-set would repeat configuration unnecessarily.

Why this answer

Option C is correct because the most efficient approach is to either modify the existing rule-set's 'from zone' statement to include the DMZ zone (if the same pool and translation are desired) or create an additional rule-set for the DMZ zone. This reuses the existing NAT pool and configuration without global changes, preserving the trust zone rule-set's specificity.

Exam trap

JNCIA-SEC often tests whether candidates know that a single NAT rule-set can include multiple source zones — many assume each zone requires its own separate rule-set, leading them to pick the delete-and-recreate option.

How to eliminate wrong answers

Option A is wrong because global NAT mode changes the entire NAT architecture and is not the most efficient or targeted solution; it can introduce unintended NAT behavior across all zones. Option B is wrong because deleting and recreating the rule-set without a source zone removes zone-based specificity, potentially applying NAT too broadly and disrupting existing trust zone behavior. Option D is wrong because static routes do not bypass NAT requirements — NAT is a translation function, not a routing function, and DMZ hosts still need source NAT to reach the untrust zone with a public IP.

Practice this question →

39

MCQmedium

An administrator configures Destination NAT to forward incoming traffic on port 80 to an internal server. After committing, the administrator notices that ping tests to the destination NAT public IP address fail. What is the standard behavior of Destination NAT regarding ICMP ping requests?

A.ICMP ping requests are dropped by the Junos control plane as a security hardening default.

B.Destination NAT automatically translates and responds to all ICMP echo requests by default.

C.Proxy ARP on the external interface prevents ICMP echo requests from reaching the Destination NAT engine.

D.Destination NAT rules matching specific TCP/UDP ports do not translate ICMP ping traffic, leading to failed pings unless ICMP is explicitly matched.

AnswerD

Destination NAT rules matching specific TCP or UDP ports translate only that protocol traffic; ICMP carries no port information, so ping packets are not translated. This explains the failed pings unless ICMP is explicitly matched in a separate rule.

Why this answer

Destination NAT rules that match specific TCP/UDP ports (like port 80) do not translate ICMP traffic because ICMP does not use ports. Therefore, ping requests to the public IP are not forwarded to the internal server, resulting in failed pings unless an ICMP-specific Destination NAT rule is configured. This is standard Junos behavior.

Exam trap

JNCIA-SEC often tests the misconception that Destination NAT translates all traffic, but port-specific rules only match TCP/UDP, so ICMP is not translated unless explicitly matched.

How to eliminate wrong answers

Option A is wrong because Junos does not drop ICMP by default at the control plane for NAT; the issue is NAT rule matching, not a security hardening default. Option B is wrong because Destination NAT does not automatically translate ICMP; it only translates traffic that matches the rule's criteria, which typically includes port numbers. Option C is wrong because Proxy ARP is used for address resolution, not for preventing ICMP from reaching the NAT engine; it does not block ICMP.

Practice this question →

40

Multi-Selectmedium

When troubleshooting a Source NAT configuration where internal users cannot reach external resources, which TWO verification checks should an administrator perform? (Choose two)

Select 2 answers

A.Verify SNMP community string configurations.

B.Verify interface duplex settings on internal switch ports.

C.Verify rule hit counters and matches using 'show security nat rule-set'.

D.Verify BGP peer state for external routing tables.

E.Verify active NAT translation using 'show security flow session'.

AnswersC, E

Rule hit counters confirm whether traffic actually matches the source NAT rule-set and which rule applies. If counters stay at zero, the traffic is bypassing NAT entirely, so the constraint of internal users failing to reach external resources is traced to a rule-match or ordering problem rather than translation itself.

Why this answer

Option C is correct because 'show security nat rule-set' displays the hit counters and match statistics for each source NAT rule, so an administrator can confirm whether traffic is actually matching the intended rule and whether the rule is being evaluated in the correct rule-set order. Option E is correct because 'show security flow session' reveals the active sessions and their NAT translations, letting the administrator verify that source NAT is being applied to the internal users' traffic and that translated addresses/ports are present. Options A, B, and D do not belong: SNMP community strings are for monitoring/management access and have no bearing on NAT translation, interface duplex mismatches would cause link-level errors rather than a NAT rule problem, and BGP peer state affects route propagation to external networks but does not verify whether source NAT is correctly matching and translating internal user traffic.

Exam trap

JNCIA-SEC often tests whether candidates confuse routing/monitoring checks (BGP, SNMP, duplex) with the NAT-specific verification commands that actually prove SNAT is matching and translating.

Practice this question →

41

MCQmedium

An SRX Series device sits between a trusted zone and an untrusted zone. A web server at 10.10.10.50 in the trusted zone must be reachable from the untrusted zone at 198.51.100.25. You want inbound connections to that public address to be translated to the internal server while preserving the destination port. Which Junos configuration element accomplishes this?

A.A security policy from untrusted to trusted that permits the public address and an address book entry for 10.10.10.50

B.A static NAT rule mapping 198.51.100.25 to 10.10.10.50 in the source NAT rule set

C.A destination NAT rule with a destination address of 198.51.100.25 and a destination address translation of 10.10.10.50

D.A source NAT rule with a source address of 198.51.100.25 and a translated source of 10.10.10.50

AnswerC

Destination NAT rewrites the destination IP of inbound packets, so a rule matching the public address with a translated address of the internal server delivers traffic to 10.10.10.50 while the original port is retained. This is the standard Junos mechanism for publishing an internal host through an SRX.

Why this answer

Destination NAT is the Junos feature that translates the destination address of inbound flows. Matching the published public address and translating it to the internal server address allows external clients to reach the server while keeping the original service port intact. Security policy and routing still apply, but the address rewrite itself is performed by the destination NAT rule.

Exam trap

The trap here is assuming that a security policy permitting the public address is enough to reach the internal server, when the destination address must first be rewritten by a destination NAT rule.

Practice this question →

42

MCQeasy

Which Junos configuration mode command is used to enter the NAT configuration hierarchy?

A.edit system nat-configuration

B.edit security nat

C.edit routing-options nat

D.edit firewall nat

AnswerB

edit security nat moves the CLI into the NAT configuration hierarchy, from which source, destination and static NAT rule-sets are configured. It satisfies the stem's requirement for the configuration mode command that enters the NAT hierarchy, rather than an operational show command.

Why this answer

The correct command to enter the NAT configuration hierarchy on a Junos SRX is 'edit security nat'. This places the user in [edit security nat] where source, destination, and static NAT rules are configured. NAT is a security feature on SRX, so it resides under the 'security' hierarchy, not under system, routing-options, or firewall.

Exam trap

JNCIA-SEC often tests the correct hierarchy for NAT, tricking candidates into selecting 'firewall nat' or 'system nat' because they associate NAT with firewalls or system services, rather than the correct 'security nat' hierarchy.

How to eliminate wrong answers

Option A is wrong because 'edit system nat-configuration' is not a valid hierarchy; system-level NAT configuration does not exist in Junos. Option C is wrong because 'edit routing-options nat' is invalid — routing-options deals with routing protocols and static routes, not NAT. Option D is wrong because 'edit firewall nat' is not a valid hierarchy; firewall filters are under [edit firewall], but NAT is under [edit security nat].

Practice this question →

43

MCQmedium

An administrator configures Interface-based Source NAT. When checking operational status, the administrator wants to verify which interface IP is being used for translation and confirm traffic flow. Which command provides detailed flow session information including the translated interface IP?

A.show nat interface statistics

B.show security interface nat-status

C.show security flow session

D.show system services interface translation

AnswerC

The show security flow session command displays active session details, including source and destination addresses, ports, and the translated interface IP applied by source NAT. This confirms which interface address is performing translation and verifies the traffic flow, satisfying the operational verification requirement.

Why this answer

The 'show security flow session' command on Junos SRX displays detailed session information including the source and destination addresses before and after NAT translation, the translated interface IP, and the session state. This makes it the correct tool for verifying which interface IP is being used for source NAT translation while confirming active traffic flow. It provides both the pre-NAT and post-NAT tuples, which is exactly what the administrator needs.

Exam trap

JNCIA-SEC often tests whether candidates know the exact operational command syntax for verifying NAT translations, and many confuse 'show security flow session' with non-existent NAT-specific status commands.

How to eliminate wrong answers

Option A is wrong because 'show nat interface statistics' is not a valid Junos command — NAT statistics are viewed via 'show security nat source summary' or similar, not per-interface statistics. Option B is wrong because 'show security interface nat-status' does not exist in Junos OS; interface NAT status is not a standalone operational command. Option D is wrong because 'show system services interface translation' is a fabricated command that does not exist on SRX devices.

Practice this question →

44

Multi-Selecthard

Which THREE operational commands are valid for troubleshooting NAT and flow sessions on a Junos OS SRX Series device? (Choose three)

Select 3 answers

A.show security nat pool

B.show security flow session

C.show system nat-cache status

D.show firewall nat-counters

E.show security nat rule-set

AnswersA, B, E

show security nat pool displays configured NAT pools, their address ranges and current utilisation, confirming whether pool allocation is exhausted. This directly supports troubleshooting NAT translation failures, satisfying the question's requirement for a valid NAT troubleshooting command.

Why this answer

Option A, 'show security nat pool', is correct because it displays configured NAT pools on an SRX, including pool name, address ranges, port ranges, and utilization statistics, which is essential for verifying that source or destination NAT pools are correctly defined and not exhausted. Option B, 'show security flow session', is correct because it lists active flow sessions with their NAT translations (source/destination addresses and ports before and after translation), letting you confirm that traffic is being matched and translated as expected. Option E, 'show security nat rule-set', is correct because it shows the configured NAT rule sets, their rules, and match conditions, which is necessary to verify that the intended NAT rules exist and are ordered correctly.

Option C, 'show system nat-cache status', is not a valid Junos OS command on SRX, as there is no such nat-cache status operational command. Option D, 'show firewall nat-counters', is also not a valid Junos OS SRX command; NAT-related counters are viewed through other commands such as 'show security nat source summary' or 'show security flow session', not a 'show firewall nat-counters' command.

Exam trap

JNCIA-SEC often tests command validity by mixing real Junos commands with plausible-sounding but non-existent ones, so candidates must memorize the exact 'show security nat' and 'show security flow' command families.

Practice this question →

45

Multi-Selectmedium

An administrator is configuring source NAT with a pool on an SRX Series device. The pool contains multiple IP addresses, and the administrator wants to understand the allocation behavior for source ports when multiple internal hosts are translated. Which two statements correctly describe how source NAT pool allocation works? (Choose two.)

Select 2 answers

A.The SRX always uses the same external IP address for all sessions from a given internal host, regardless of the pool configuration.

B.The SRX allocates source ports from a pool IP address and may use different IP addresses for different sessions from the same internal host.

C.The SRX uses the same source port for all sessions from the same internal host, even if the external IP address changes.

D.The SRX preserves the original source port whenever possible, and if the port is already in use, it translates the port to a different value.

E.The SRX allocates source ports sequentially from the first IP address in the pool until all ports are exhausted, then moves to the next IP address.

AnswersB, D

When a source NAT pool with multiple addresses is used, the SRX can allocate different external IP addresses for different sessions originating from the same internal host. This is known as round-robin or dynamic allocation. It helps distribute the load across the pool addresses and reduces the chance of port exhaustion on a single address. The allocation is based on the algorithm configured, such as round-robin or least-connections.

Why this answer

Source NAT pool allocation distributes sessions across multiple external IP addresses, and the SRX attempts to preserve the original source port when possible. If the port is already in use, it translates the port. These two behaviors are fundamental to how source NAT pools operate on Junos SRX devices.

Exam trap

The trap here is confusing address-persistent NAT, which keeps the same external IP for a host, with the default pool allocation behavior that may use different addresses.

Practice this question →

46

Multi-Selectmedium

Which TWO troubleshooting steps should an administrator take when a Source NAT pool reports port exhaustion? (Choose two)

Select 2 answers

A.Clear the routing forwarding table.

B.Configure port-sharing or review persistent-nat settings to optimize port distribution across pool addresses.

C.Convert all Source NAT rules into Destination NAT rules.

D.Add additional public IP addresses to the source NAT pool.

E.Disable security flow processing on the trust zone.

AnswersB, D

Port exhaustion arises because too few ports are available per pool address. Enabling port sharing lets multiple sessions reuse ports, while tuning persistent-NAT settings prevents sticky allocations from consuming ports unnecessarily, restoring distribution across the pool's addresses.

Why this answer

Option B is correct because Source NAT port exhaustion occurs when the available source ports on the pool's IP addresses are consumed; enabling port-sharing (allowing multiple sessions to share translated ports via different source addresses/ports) or reviewing persistent NAT settings (which can pin mappings and reduce reusable ports) directly optimizes how ports are distributed across the pool addresses. Option D is correct because the fundamental capacity limit is (number of pool IPs × available ports per IP), so adding more public IP addresses to the source NAT pool increases the total port capacity and relieves exhaustion. Option A is wrong because clearing the routing forwarding table does not free NAT port allocations and would disrupt traffic without addressing the port shortage.

Option C is wrong because converting Source NAT to Destination NAT changes the traffic direction/purpose entirely and does not solve outbound translation port exhaustion. Option E is wrong because disabling security flow processing on the trust zone would break stateful inspection and NAT processing rather than resolve the port exhaustion.

Exam trap

JNCIA-SEC often tests the misconception that clearing tables or disabling security features resolves NAT issues, when the correct approach is to expand pool capacity or optimize port allocation settings.

Practice this question →

47

MCQhard

You are troubleshooting a scenario where an SRX device is performing Static NAT for a web server. External users experience intermittent packet drops when loading large web pages. Flow traceoptions show TCP fragmentation issues and ICMP 'Fragmentation Needed' messages being dropped by the security device. Which feature should be checked or configured to resolve this Path MTU Discovery (PMTUD) issue?

A.Disable the security ALG for TCP streams to allow raw fragmentation forwarding.

B.Configure a Destination NAT pool specifically for ICMP fragmentation packets.

C.Enable proxy-arp for all fragmented packet ranges on the static NAT interface.

D.Configure TCP MSS (Maximum Segment Size) adjustment on the security policies or zones to prevent packets from exceeding the path MTU.

AnswerD

TCP MSS adjustment clamps the maximum segment size advertised during the handshake, keeping packets within the path MTU so they need no fragmentation. This directly resolves the dropped ICMP Fragmentation Needed messages described in the stem.

Why this answer

Path MTU Discovery relies on ICMP 'Fragmentation Needed' messages to tell the sender to reduce packet size. If the SRX drops these ICMP messages or large TCP segments, PMTUD breaks and large web pages stall. Configuring TCP MSS adjustment (clamping) on the security policies or zones ensures TCP segments never exceed the path MTU, preventing fragmentation issues without relying on ICMP.

Exam trap

JNCIA-SEC often tests the misconception that disabling ALGs or adding NAT rules fixes MTU issues, when the correct fix is TCP MSS clamping to avoid reliance on ICMP PMTUD messages.

How to eliminate wrong answers

Option A is wrong because disabling the TCP ALG does not solve PMTUD issues and may break other TCP-based applications that rely on ALG inspection. Option B is wrong because creating a Destination NAT pool for ICMP fragmentation packets is not a valid or effective solution — NAT pools do not address MTU discovery. Option C is wrong because enabling proxy-arp for fragmented packet ranges does not resolve PMTUD; proxy-arp is for address resolution, not MTU handling.

Practice this question →

48

MCQeasy

An administrator needs to configure Destination NAT to map incoming traffic destined for a public IP address (203.0.113.50) on port 443 to an internal web server at private IP address (192.168.1.100) on port 8443. Which configuration hierarchy is used to define the pool for this destination NAT mapping?

A.set security nat destination rule-set rs1 rule r1 then translation pool web-pool

B.set security nat source pool web-pool address 192.168.1.100 port 8443

C.set security nat static rule-set static-rs rule r1 then destination-nat pool web-pool

D.set security nat destination pool web-pool address 192.168.1.100 port 8443

AnswerD

The destination NAT pool defines the translated address and port. Specifying the private IP with port 8443 in the pool maps inbound port 443 traffic to the internal web server's actual listening port, satisfying the required translation.

Why this answer

Destination NAT pools in Junos are defined under the [security nat destination] hierarchy, where the pool name and its translated address/port are configured. The correct command 'set security nat destination pool web-pool address 192.168.1.100 port 8443' creates the pool that the destination NAT rule will reference in its 'then destination-nat pool' action. This is the pool definition step, distinct from the rule-set/rule that performs the actual matching and translation binding.

Exam trap

JNCIA-SEC often tests the distinction between the pool definition hierarchy and the rule action hierarchy — candidates confuse 'destination pool' (the object) with 'destination-nat pool' (the rule action) and pick the rule-set line instead of the pool line.

How to eliminate wrong answers

Option A is wrong because 'set security nat destination rule-set rs1 rule r1 then translation pool web-pool' is not valid Junos syntax — the correct action keyword is 'destination-nat pool', not 'translation pool', and this line also defines a rule action rather than the pool itself. Option B is wrong because 'security nat source pool' defines a Source NAT pool, not a Destination NAT pool, and would be used for translating outbound source addresses. Option C is wrong because 'security nat static' is used for static NAT (one-to-one bidirectional mappings), not for defining a destination NAT pool, and 'destination-nat pool' is not a valid statement under the static hierarchy.

Practice this question →

49

MCQeasy

A network administrator is configuring source NAT on an SRX Series device. The internal network 192.168.50.0/24 must be translated to the external interface address when traffic leaves the trust zone toward the untrust zone. The administrator wants to use interface-based source NAT. Which configuration statement correctly applies interface source NAT to the rule?

A.set security nat source rule-set trust-to-untrust rule r1 then source-nat pool

B.set security nat source rule-set trust-to-untrust rule r1 then destination-nat interface

C.set security nat source rule-set trust-to-untrust rule r1 then source-nat static

D.set security nat source rule-set trust-to-untrust rule r1 then source-nat interface

AnswerD

This statement configures the rule to use interface-based source NAT, which translates the source address to the IP address of the egress interface. It is the correct action for the described requirement because the administrator wants to use the external interface address. The rule must also have a match condition for the source subnet, but the then source-nat interface action is the key element that performs interface NAT.

Why this answer

Interface-based source NAT translates the source address to the egress interface IP address, which matches the requirement to use the external interface address for the 192.168.50.0/24 subnet. The correct action is then source-nat interface. Pool-based NAT would require a defined address pool, and destination NAT or static NAT would not provide the required many-to-one translation for outbound traffic.

Exam trap

The trap here is selecting a pool-based action when the requirement explicitly asks for interface-based source NAT.

Practice this question →

50

Multi-Selectmedium

When configuring a Source NAT pool with multiple IP addresses on a Junos OS device, which TWO allocation methods or behaviors apply to how addresses and ports are assigned? (Choose two)

Select 2 answers

A.Pool addresses are assigned exclusively on a round-robin basis without port translation.

B.All internal hosts are forced to share exactly one single static MAC address regardless of pool size.

C.Sessions are distributed across multiple pool IP addresses to balance utilization.

D.Port allocation is static and restricted to well-known ports (0-1023).

E.Port Address Translation (PAT) allocates available source ports for each pool IP address.

AnswersC, E

Junos source NAT pools with multiple addresses distribute sessions across those addresses, balancing utilisation rather than exhausting one address before moving to the next. This satisfies the stem's question about allocation behaviour across pool IP addresses.

Why this answer

Option C is correct because a Junos source NAT pool with multiple addresses distributes translated sessions across the pool's IP addresses, balancing utilization rather than pinning all translations to one address. Option E is correct because when a source NAT pool is configured, Junos performs Port Address Translation (PAT), allocating available source ports from each pool IP address so many internal hosts can share the pool addresses. Option A is wrong because allocation is not a simple round-robin without port translation; PAT port allocation is involved.

Option B is wrong because NAT translation concerns IP addresses and ports, not forcing all hosts to share one static MAC address. Option D is wrong because PAT uses the dynamic/ephemeral source port range, not a static restriction to well-known ports 0-1023.

Exam trap

The trap is assuming pool addresses are assigned without port translation or that PAT is limited to well-known ports, when Junos actually uses PAT across the full ephemeral range with session distribution.

Practice this question →

51

MCQmedium

An administrator implements Source NAT using a pool of IP addresses. To verify the operational status of the source NAT pool and see how many addresses and ports are currently in use, which operational command should be executed?

A.show system nat pool-utilization

B.show security flow pool-status

C.show security nat pool

D.show route forwarding-table nat-pool

AnswerC

show security nat pool reports each pool's address and port utilisation, showing how many addresses and ports are currently allocated. It satisfies the stem's requirement for verifying operational status of the source NAT pool, unlike flow session output which shows individual translations.

Why this answer

The operational command 'show security nat pool' displays the status of all configured NAT pools, including the pool name, address range, and current utilization statistics such as the number of addresses and ports in use. This is the correct command to verify Source NAT pool operational status and utilization.

Exam trap

JNCIA-SEC often tests the exact operational command names for verifying NAT status, and candidates confuse 'show security nat pool' with non-existent commands like 'show system nat pool-utilization' or 'show security flow pool-status'.

How to eliminate wrong answers

Option A is wrong because 'show system nat pool-utilization' is not a valid Junos operational command — there is no such command in the Junos CLI. Option B is wrong because 'show security flow pool-status' is not a valid command; flow-related commands use 'show security flow session' for session information, not pool status. Option D is wrong because 'show route forwarding-table nat-pool' is not a valid command — the forwarding table command does not have a NAT pool option.

Practice this question →

52

MCQeasy

Which keyword is used in a Junos source NAT rule to specify that traffic should be translated to the IP address of the egress interface?

A.interface

B.address-pool

C.egress-ip

D.self

AnswerA

The interface keyword makes the SRX translate the source address to the egress interface's own IP address, satisfying the requirement to use that address rather than a configured pool. This suits dynamic WAN addressing where the egress IP is not statically known.

Why this answer

In a Junos source NAT rule, the 'interface' keyword tells the SRX to translate the source address to the IP address of the egress interface. This is configured under 'then source-nat interface' within the rule. It is the standard way to perform interface-based PAT without defining an address pool.

Exam trap

The trap is mixing up pool-based source NAT (address-pool) with interface-based source NAT (interface); candidates often choose 'address-pool' because they think a pool is always required, but the question specifically asks for egress interface translation.

How to eliminate wrong answers

Option B is wrong because 'address-pool' references a named pool of addresses for translation, not the egress interface address. Option C is wrong because 'egress-ip' is not a valid Junos NAT keyword. Option D is wrong because 'self' is not the keyword used for interface-based source NAT; it is not a recognized source-nat action in this context.

Practice this question →

53

MCQhard

An administrator is configuring static NAT on an SRX Series device to map a public IP address 203.0.113.100 to an internal server at 10.20.30.40. The internal server hosts both HTTP and HTTPS services. The administrator wants to ensure that traffic destined to 203.0.113.100 on any port is translated to 10.20.30.40, preserving the original destination port. Which configuration statement correctly achieves this?

A.set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.100/32 destination-port 80

B.set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.100/32

C.set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.100/32 destination-port 443

D.set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.100/32 destination-port 0

AnswerB

This statement matches all traffic destined to the public address 203.0.113.100 without restricting the port. When combined with a then static-nat prefix mapping to 10.20.30.40, it translates the destination address while preserving the original destination port. This satisfies the requirement to translate any port to the internal server while keeping the port unchanged.

Why this answer

To translate all traffic regardless of port, the static NAT rule should match only the destination address. Omitting the destination-port condition allows the rule to match any port, and the static NAT translation will preserve the original port. Specifying a particular port would limit the rule to that service only, which does not meet the requirement.

Exam trap

The trap here is adding a destination-port match when the requirement is to translate all ports, which inadvertently restricts the rule.

Practice this question →

54

MCQmedium

An administrator configures Source NAT for an internal subnet. After committing the changes, users report that they can access external websites via IP addresses, but domain name resolution (DNS) is failing. Investigation shows DNS UDP port 53 traffic is being blocked or failing NAT translation. What is the most likely reason?

A.Source NAT automatically disables DNS Application Layer Gateways (ALGs), causing DNS packets to be dropped.

B.Security policies do not permit UDP port 53 (DNS) traffic between the source and destination zones.

C.Source NAT pools strip UDP port headers, preventing DNS responses from matching.

D.DNS traffic requires Static NAT and cannot traverse Source NAT pools.

AnswerB

Source NAT rewrites addresses but does not bypass policy. DNS uses UDP port 53, which the zone-pair security policy must explicitly permit; HTTP on TCP 80/443 is allowed, so browsing works while name resolution fails. The missing permit for UDP 53 is the cause.

Why this answer

The most likely reason DNS is failing while IP-based access works is that the security policy does not permit UDP port 53 traffic between the relevant zones. Source NAT translates addresses but does not bypass security policy evaluation; if the policy does not allow DNS, the traffic is dropped. This is a common oversight when configuring NAT without corresponding security policies.

Exam trap

JNCIA-SEC often tests the interaction between NAT and security policies, and candidates mistakenly believe that NAT automatically permits traffic or that DNS requires special NAT handling, when the real issue is usually a missing policy.

How to eliminate wrong answers

Option A is wrong because Source NAT does not automatically disable DNS ALGs — ALGs are separate features and are not disabled by NAT configuration. Option C is wrong because Source NAT pools do not strip UDP port headers; NAT translation preserves transport-layer information and rewrites only IP addresses and optionally ports. Option D is wrong because DNS traffic can traverse Source NAT pools without issue — DNS does not require Static NAT; Source NAT with port translation handles UDP 53 correctly as long as policies permit it.

Practice this question →

55

MCQmedium

An administrator configures a destination NAT rule on an SRX Series device to redirect inbound HTTP traffic destined to 203.0.113.10 port 80 to an internal web server at 10.10.10.5. After committing, users on the internet can reach the web server, but the internal server logs show the source IP address of the original client instead of the SRX's IP address. Which statement explains this behavior?

A.Destination NAT automatically performs source NAT using the egress interface address, which is why the server sees the client IP.

B.Destination NAT translates only the destination IP address; the source IP address is preserved by default unless source NAT is also applied.

C.The SRX is configured in transparent mode, which prevents source NAT from modifying packet headers.

D.The security policy is blocking source NAT translation, so the packet retains the original source address.

AnswerB

Destination NAT on Junos OS modifies only the destination IP address (and optionally port) of matching packets. The source IP address remains unchanged, so the internal server sees the original client's IP. To alter the source address, a separate source NAT rule must be configured, such as interface NAT or a source NAT pool. This scenario correctly reflects that behavior.

Why this answer

Destination NAT changes only the destination IP address of matching packets. The source IP address is left intact unless a separate source NAT rule is applied. In this scenario, the administrator configured only destination NAT, so the internal server observes the original client IP.

Adding a source NAT rule would translate the source address, but that is a distinct configuration step.

Exam trap

The trap here is assuming that destination NAT also translates the source address, when in fact source NAT must be configured separately.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Network Address Translation questions.

Start 20-question session