A Destination NAT rule by itself replaces the need for a security policy allowing Internet-to-DMZ traffic.

### Why this is right The lab sets up security policies and Destination NAT as separate tasks. Translation directs the packet to the server, while the security policy permits traffic between zones. ### The concept NAT and security policy solve different problems. Destination NAT changes the destination address from the firewall's Internet-facing address to the DMZ server. A security policy determines whether the matching traffic is allowed to pass. Successful inbound web access depends on configuring the relevant forwarding and permission settings. ### The other options - **True**: this would confuse address translation with access control. The lab requires both functions for its intended setup. ### Terms - **Access control**: Rules that determine whether traffic is permitted. - **Destination NAT**: Destination Network Address Translation, which changes a packet's destination address. ### Remember NAT points traffic to a destination; a policy decides whether the firewall permits it.