SSCP Systems Security Certified PractitionerNetwork and Communications SecurityHard
A network administrator is troubleshooting an issue where a server in the DMZ cannot receive incoming connections from the internet, despite the perimeter firewall having an explicit rule to allow traffic to the server's public IP address on the correct port. Upon further investigation, it is discovered that the server's private IP address is 10.0.0.50, and the public IP address configured on the firewall for this server is 203.0.113.10. Which network service is likely misconfigured or missing, preventing the connections?
- ADHCP
- BDNS
- CARP
- DNAT
Show answer & explanationAnswer & explanation
Correct answer: D. NAT
Network Address Translation (NAT), specifically Destination NAT (DNAT) or port forwarding, is required to translate the public IP address (203.0.113.10) and port to the server's private IP address (10.0.0.50) in the DMZ. Without proper NAT configuration, the firewall would not know how to direct incoming traffic from the internet to the internal private IP.
Why the other options are wrong
- A. DHCP (Dynamic Host Configuration Protocol) assigns IP addresses but is not directly involved in translating public to private IP addresses for incoming internet connections.
- B. DNS (Domain Name System) resolves domain names to IP addresses. While DNS might point to the public IP, it doesn't handle the internal translation to the private IP.
- C. ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses within a local network segment, which is not the issue for translating public to private IPs across network boundaries.
Destination NAT (DNAT)
A form of Network Address Translation used to change the destination IP address of incoming packets, typically from a public IP to a private IP.
- Enables external hosts to initiate connections to internal servers.
- Often used for servers in a DMZ or internal network.
- Also known as port forwarding when combined with port translation.
Memory trick: Network Address Translation: DHCP gives, DNS resolves, ARP maps, NAT translates.