CCNA Network Address Translation Questions — Page 2 of 2

MCQeasy

Which Junos configuration command correctly establishes a destination NAT pool pointing to an internal server IP address of 10.2.2.50?

A.set security nat destination address-pool srv-pool 10.2.2.50

B.set security nat pool destination srv-pool 10.2.2.50

C.set security nat destination pool srv-pool address 10.2.2.50/32

D.set security nat destination rule-set rs1 pool srv-pool address 10.2.2.50

AnswerC

This is the correct Junos syntax for defining a destination NAT pool with a specific host IP.

Why this answer

Destination NAT pools are defined under 'security nat destination pool <name> address <ip-address>'.

Practice this question →

MCQeasy

Which Junos command displays summary counters for all configured NAT rule sets across source, destination, and static NAT?

A.show security nat summary

B.show security flow summary nat

C.show security nat rule-set

D.show system nat counters

AnswerC

This command displays rule-sets, rules, and their respective operational hit counters and summary data.

Why this answer

To view summary counters and hit counts for NAT rules and rule-sets, 'show security nat summary' or rule-set summary commands are used.

Practice this question →

Multi-Selectmedium

When configuring a Source NAT pool with multiple IP addresses on a Junos OS device, which TWO allocation methods or behaviors apply to how addresses and ports are assigned? (Choose two)

Select 2 answers

A.Pool addresses are assigned exclusively on a round-robin basis without port translation.

B.All internal hosts are forced to share exactly one single static MAC address regardless of pool size.

C.Sessions are distributed across multiple pool IP addresses to balance utilization.

D.Port allocation is static and restricted to well-known ports (0-1023).

E.Port Address Translation (PAT) allocates available source ports for each pool IP address.

AnswersC, E

Multi-address source NAT pools distribute connections across pool addresses.

Why this answer

Junos distributes sessions across pool addresses and uses PAT port allocations per source IP.

Practice this question →

MCQmedium

An administrator implements Source NAT using a pool of IP addresses. To verify the operational status of the source NAT pool and see how many addresses and ports are currently in use, which operational command should be executed?

A.show system nat pool-utilization

B.show security flow pool-status

C.show security nat pool

D.show route forwarding-table nat-pool

AnswerC

The 'show security nat pool' command displays active allocations, pool utilization, and port usage for configured NAT pools.

Why this answer

To view statistics and usage of NAT pools, the command 'show security nat pool' is used.

Practice this question →

MCQeasy

Which keyword is used in a Junos source NAT rule to specify that traffic should be translated to the IP address of the egress interface?

A.interface

B.address-pool

C.egress-ip

D.self

AnswerA

Using 'then source-nat interface' tells the SRX to translate source IPs to the IP address configured on the egress interface.

Why this answer

To use interface-based source NAT, the 'interface' keyword is specified under the rule's 'then source-natal' action.

Practice this question →

Multi-Selecteasy

Which TWO Junos CLI commands are valid configuration shortcuts or roots when managing security NAT? (Choose two)

Select 2 answers

A.show security nat rule-set

B.edit system nat-mode

C.edit routing-options nat-pool

D.edit security nat

E.show firewall nat-status

AnswersA, D

Displays configured NAT rule-sets and hit counts.

Why this answer

Valid NAT roots include 'edit security nat' and viewing rule-sets via operational commands.

Practice this question →

MCQeasy

Which Junos configuration command displays the active NAT translation mappings and session details for a specific source IP address?

A.show security nat translation match 192.168.1.50

B.show security flow session match source-prefix 192.168.1.50

C.show route forwarding-table source 192.168.1.50

D.show system nat sessions source 192.168.1.50

AnswerB

This command filters active flow sessions by source IP, displaying pre-NAT and post-NAT addresses.

Why this answer

To inspect active sessions matching a specific source IP address to verify NAT, 'show security flow session match source-prefix <ip>' is used.

Practice this question →

MCQmedium

An administrator configures Source NAT for an internal subnet. After committing the changes, users report that they can access external websites via IP addresses, but domain name resolution (DNS) is failing. Investigation shows DNS UDP port 53 traffic is being blocked or failing NAT translation. What is the most likely reason?

A.Source NAT automatically disables DNS Application Layer Gateways (ALGs), causing DNS packets to be dropped.

B.Security policies do not permit UDP port 53 (DNS) traffic between the source and destination zones.

C.Source NAT pools strip UDP port headers, preventing DNS responses from matching.

D.DNS traffic requires Static NAT and cannot traverse Source NAT pools.

AnswerB

NAT performs address translation, but traffic must still be explicitly permitted by security policies. If DNS is blocked, security policies are the primary suspect.

Why this answer

If DNS is failing after source NAT configuration, ensure that security policies permit UDP port 53 outbound from the trust zone to the untrust zone, and that NAT rules do not inadvertently exclude or drop DNS traffic applications.

Practice this question →

MCQhard

You are reviewing a Junos configuration containing both Destination NAT and Static NAT. An incoming packet matches both a Destination NAT rule and a Static NAT rule. Based on Junos OS NAT processing architecture, how is this conflict handled?

A.The SRX device generates a syntax error upon commit if overlapping Destination and Static NAT rules exist.

B.Both translations are applied simultaneously, resulting in double destination translation.

C.Destination NAT is evaluated first; if a match occurs, the packet is translated by Destination NAT and subsequent NAT stages are skipped for that transformation stage.

D.Static NAT takes precedence over Destination NAT because it provides a bidirectional mapping.

AnswerC

Since Destination NAT is evaluated before Static NAT in the processing sequence, the matching Destination NAT rule takes precedence.

Why this answer

Junos OS evaluates Destination NAT first and Static NAT last. However, within distinct processing pipelines, a packet is evaluated against rule sets in order. Destination NAT rule-sets are evaluated before Static NAT rule-sets.

If a packet matches a Destination NAT rule, that NAT is applied and evaluation for that stage finishes.

Practice this question →