In a zone-based firewall, a Source NAT rule configured with only the Internal zone as its source zone automatically translates outbound traffic originating from a separate DMZ zone.

### Why this is right After configuring Internal-to-Internet Source NAT, the lab instructs students to use that procedure as a basis for allowing DMZ access to the Internet. ### The concept The DMZ and Internal network are separate zones, so a rule matching Internal does not automatically match DMZ traffic. The lab calls for the DMZ's outbound access to be configured and then tested from condorID-WS1. Security-policy permission and NAT configuration remain distinct parts of the setup. ### Terms - **DMZ**: Demilitarized Zone. A network segment used for services with different exposure from Internal hosts. ### Remember A separate source zone generally needs a rule that matches that zone's traffic.