PCNSE Core Concepts and Architecture Practice Question
A network engineer configures a Source NAT policy on a Palo Alto Networks firewall to translate internal private IP addresses to the public IP of the external interface. The NAT rule is configured with source zone 'internal', destination zone 'external', and uses 'interface address' as the translated address. The associated security rule allows traffic from 'internal' to 'external' with the translated IP as the source. After committing, users cannot access the internet. Traceroute from an internal host to 8.8.8.8 shows: Hop 1: 192.168.1.1 (firewall internal IP), Hop 2: * * * (no response). The firewall's external interface has a public IP and is in the 'external' zone. What is the most likely cause of the issue?
⚠ Common exam trap
The trap here is that candidates often focus on the destination zone or security rule configuration, overlooking that the NAT rule's source zone must match the actual traffic ingress zone, not the zone of the translated address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT rule's source zone is configured as 'external' instead of 'internal'.
The NAT rule's source zone must match the zone of the incoming traffic. If the source zone is set to 'external' instead of 'internal', the firewall will not apply the NAT rule to traffic arriving from the internal zone. As a result, packets are forwarded without translation, and the security rule expecting the translated IP as the source will not match, causing traffic to be dropped. The traceroute showing no response beyond the firewall's internal IP confirms that packets are not being translated or forwarded correctly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security rule's action is set to 'deny' for the translated IP.
Why it's wrong here
The security rule is described as allowing traffic, so unlikely.
- ✓
The NAT rule's source zone is configured as 'external' instead of 'internal'.
Why this is correct
If the source zone is 'external', the internal traffic will not match the NAT rule, so no source translation occurs.
- ✗
The firewall's default route is missing.
Why it's wrong here
A missing default route would cause no hop 1 response; traceroute shows hop 1, so firewall is reachable.
- ✗
The NAT rule is configured with destination zone 'any' but should be 'external'.
Why it's wrong here
Using 'any' for destination zone would still match; the issue is more likely source zone.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.