A manufacturer is inserting an FTD appliance in routed mode between its core switch and the ISP router. Inside hosts use 10.20.0.0/16, the ISP gives a public /30 for the outside link and routes a public /29 for published services, while four web servers must stay publicly reachable on private addresses. Which routed-mode configuration meets these requirements?
Select an answer to reveal the explanation.
Short Explanation
With static NAT each server gets a public face while it keeps its private address inside, so inbound connections land exactly where you need them. Routing alone only moves packets, and one-way PAT doesn't open a door going in.
Full Explanation
The required design keeps the FTD in routed mode, gives its inside and outside interfaces addresses in their respective networks, and uses a route toward the ISP for external destinations. The ISP-routed /29 supplies distinct public addresses for the four published services. Static one-to-one mappings associate those addresses with the servers’ private 10.20.0.0/16 addresses, while the access control policy permits the intended inbound web traffic; NAT translation alone does not authorize that traffic. A reverse proxy can commonly publish several private servers behind one public address, but using the outside /30 address instead of addresses from the routed /29 fails the stated public-addressing requirement. Static mappings are also a standard part of the design, but relying on NAT rules alone omits the required access-control permission, so inbound sessions are not allowed merely because a translation exists. Assigning addresses from the /29 directly to the servers is a viable pattern in some networks, but it violates the explicit requirement that these servers remain on private addresses. Exam caveat: routed prefixes often need a route or other delivery mechanism through the ISP, and the exact NAT and access-control rule ordering depends on FTD software version and policy design. Practical check: verify ISP reachability for the /29, confirm each public-to-private translation, then test permitted inbound HTTP/HTTPS connections and confirm that unapproved traffic remains denied.