To exempt a specific traffic flow from Network Address Translation (NAT), the correct method is to create a dedicated NAT policy rule. This rule must be configured to match the specific source and destination parameters of the traffic flow you wish to exempt. Within this rule, the "Translation Type" must be set to "None." This explicitly instructs the firewall not to perform any address translation on the matching packets. For this exemption to be effective, the No-NAT rule must be placed higher in the rule order than any broader NAT rule that would otherwise match and translate the traffic.

A. Security policy rules are processed separately from NAT rules and are used to allow or deny traffic, not to control address translation.

C. A static NAT rule is typically used for inbound one-to-one address mapping, and an application override is for bypassing App-ID, neither of which creates a NAT exemption.

D. A static NAT rule inherently performs translation, which is the opposite of the "No-NAT" requirement to exempt a flow from translation.

1. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide 10.2. Chapter: "NAT"

Section: "NAT Policy Rules"

Subsection: "Translated Packet Tab". The documentation states: "None—Select if you do not want to apply NAT to traffic that matches the Original Packet criteria. This is useful when you want to exempt a specific address or range of addresses from NAT."

2. Palo Alto Networks. (2023). Palo Alto Networks Certified Network Security Administrator (PCNSA) Study Guide. Chapter 7: "NAT"

Section: "NAT Policy Rules". This official study guide explains that to exclude traffic from NAT

a NAT policy rule must be created with the translation type set to "None" and placed before other matching NAT rules.