Exam 300-710 topic 1 question 68 discussion

The issue described is likely due to the absence of a NAT exemption rule, which is necessary for allowing return traffic to pass through the firewall correctly. In this case, the most appropriate answer is: A. A manual NAT exemption rule does not exist at the top of the NAT table Without this rule, the firewall might be dropping the return traffic because it doesn't match any existing NAT rules, leading to the observed behavior where traffic enters the firewall but does not leave it.

I think its a problem of expression precession "object NAT exemption rule" is more precise than "manual NAT exemption rule" (it means that we are using objects) i don't understand these kind of questions

"The NAT exemption is a preferred translation method used to prevent traffic to be routed to the internet when it is intended to flow over a VPN tunnel (Remote Access or Site-to-Site). This is needed when the traffic from your internal network is intended to flow over the tunnels without any translation." https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215875-configure-anyconnect-vpn-client-on-ftd.html#toc-hId-809586599

According with jamp1801

The reason for this issue is likely that an object NAT exemption rule does not exist at the top of the NAT table. This is necessary to allow return traffic to leave the firewall and reach the remote access VPN users. Without this rule, the firewall may perform NAT on the return traffic, causing it to be dropped or lost.

According to my knoledge about teminology, object nat does not exist in FTD, only in ASA In FTD you have manual(before and after) and auto nat rules in production enviroments it is common to create a manual nat rule before to do a NONAT for VPN Traffic, so i'll go with A

Correct answer is: D

Answer A seems to be correct https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212702-configure-and-verify-nat-on-ftd.html

NAT exemptions can only be done with manual rules before Auto/Object NAT.

D can't be correct. What is needed is a NAT exemption rule and that can only be achieved with a manual NAT rule. A is correct.

I will take it back. Original answer D is correct!

Confirmed A is correct: https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212702-configure-and-verify-nat-on-ftd.html

I think A is right