Palo Alto Networks Certified Network Security Administrator (PCNSA) — Question 164

Which statement is true regarding NAT rules?

Answer options

• A. Translation of the IP address and port occurs before security processing.
• B. Firewall supports NAT on Layer 3 interfaces only.
• C. Static NAT rules have precedence over other forms of NAT.
• D. NAT rules are processed in order from top to bottom.

Correct answer: D

Explanation

The correct answer is D, as NAT rules are indeed processed in a top-to-bottom order, which allows for predictable behavior in network address translation. Option A is incorrect because security processing occurs before NAT rules are applied. Option B is wrong as NAT can be supported on various interface types, not just Layer 3. Option C is misleading since while static NAT can have precedence, it depends on the specific configuration context.