SkillTestPro | CCNP Security 300-710 SNCF Practice Test 16

CCNP Security 300-710 SNCF Practice Test 16 (Hard) - NAT Configuration

CISCO CCNP Security Exam Logo

1 / 10

Which NAT rule type on Secure Firewall Threat Defense translates a single internal IP address to a single, fixed external IP address, maintaining a consistent one-to-one mapping?

Dynamic PAT (Port Address Translation)

NAT exemption with no translation applied

Identity NAT with no translation applied

Static NAT

Dynamic NAT with a pool of addresses

Twice NAT applied only to destination addresses

2 / 10

Which NAT type allows many internal hosts to share a single external IP address by distinguishing their connections using different source port numbers?

Dynamic PAT (Port Address Translation)

NAT exemption with no translation applied

Static NAT with a one-to-one mapping

Identity NAT with no translation applied

A routing-only configuration with no NAT involvement

A NAT rule with no pool or PAT configuration at all

3 / 10

Which NAT configuration would an administrator use to allow a specific internal web server to be reached from the internet using a single fixed public IP address, while all other outbound traffic from the internal network uses PAT?

NAT exemption applied to both the web server and all outbound traffic

A single dynamic NAT pool shared identically by the web server and all outbound traffic

Identity NAT applied to both the web server and all outbound traffic

A combination of static NAT for the web server and dynamic PAT for general outbound traffic

Dynamic PAT applied to the web server exclusively, with static NAT for general outbound traffic

No NAT configuration at all, relying solely on public IP addressing for every internal host

4 / 10

Which NAT concept refers to traffic that should bypass NAT translation entirely, commonly used for site-to-site VPN traffic between two private networks that should remain untranslated?

Static NAT with port translation

Policy-based NAT applied to all traffic uniformly

NAT exemption

Dynamic PAT

A dynamic NAT pool with overload enabled

Twice NAT applied to both source and destination unconditionally

5 / 10

Which NAT rule type allows translation decisions to be based on both source and destination criteria simultaneously, such as translating traffic differently depending on which destination network it is headed toward?

Identity NAT with no translation criteria at all

Twice NAT (manual NAT with both source and destination translation criteria)

Auto NAT (object NAT) considered strictly by itself with source-only criteria

NAT exemption with no translation criteria at all

A single static NAT rule with no destination criteria

A single dynamic PAT rule with no destination criteria

6 / 10

Which troubleshooting symptom would most likely indicate a NAT misconfiguration rather than an access control policy issue, when internal users report being unable to reach a public website?

The intrusion policy explicitly drops the connection due to a matched signature

The access control policy explicitly blocks the destination category, with no NAT rule present at all

The file policy blocks a file download due to a malware verdict

The DNS policy blocks resolution of the destination domain outright

The identity policy fails to authenticate the user at the captive portal

Outbound connections fail specifically because return traffic cannot find its way back due to missing or incorrect address translation, even though the access control policy permits the traffic

7 / 10

Which NAT rule ordering principle applies within the NAT table on Secure Firewall Threat Defense, similar to access control policy evaluation?

NAT rule order has absolutely no effect on which translation is ultimately applied

All NAT rules are always applied simultaneously with conflicting translations automatically merged

NAT rules are always evaluated in a completely random order for every new connection

NAT rules are generally evaluated in a defined order (manual/Twice NAT before Auto NAT, and top-to-bottom within each section), with the first matching rule applied

Only the very last NAT rule in the table is ever evaluated, with all earlier rules ignored

NAT rules are evaluated strictly alphabetically by rule name only

8 / 10

Which NAT-related object would an administrator configure to define the specific range of public IP addresses available for a dynamic NAT pool?

A platform settings login banner

A health policy CPU threshold

A network object representing the external IP address range used as the NAT pool

An identity policy realm

A file policy clean list

An intrusion policy variable set

9 / 10

Which scenario would most appropriately call for Identity NAT (a NAT rule that translates an address to itself, effectively performing no real translation)?

Ensuring all access control logging is disabled network-wide

Ensuring a specific traffic flow is explicitly exempted from being caught by a broader, less specific NAT rule that would otherwise apply an unwanted translation

Ensuring a host's IP address changes randomly on every new connection

Ensuring all intrusion policy rules are bypassed entirely

Ensuring all VPN tunnels are permanently disabled

Ensuring every single packet on the network is always translated to a completely different address, under normal operating conditions, under normal operating conditions

10 / 10

Which combination of NAT design practices would provide the most predictable and maintainable configuration for an enterprise with both publicly reachable servers and general internal user internet access?

A single shared dynamic PAT rule applied identically to both public servers and general user traffic, which does not align with best practices, in most deployment scenarios, regardless of the platform version in use

NAT rules left in random, unreviewed order with no periodic review of any kind

Static NAT applied to every single internal host regardless of purpose

No NAT exemption configured at all, allowing VPN traffic to be unpredictably translated

Static NAT for publicly reachable servers, dynamic PAT for general internal user outbound traffic, NAT exemption for site-to-site VPN traffic, and clear, well-ordered NAT rules reviewed periodically

Identity NAT applied to all traffic uniformly with no distinction between traffic types

Your score is

The average score is 0%