NAT and PAT questions cover static NAT (one-to-one), dynamic NAT (pool-based), and PAT/overload (many-to-one using port numbers). The CCNA asks you to read NAT table output, fix misconfigured NAT, and match the right NAT type to a scenario.
Start Scenario PracticeRefer to the exhibit. What is the effect of this NAT rule on the Cisco FTD device deployed in the cloud?
Explanation: The NAT rule shown in the exhibit is a static identity NAT (also known as NAT exempt or no-translation NAT) that translates the source IP address of traffic from the 192.168.1.0/24 network to the same IP address when going to the 10.0.0.0/24 network. This is achieved by specifying the source address as both the original and translated address, effectively bypassing any address translation while still being processed by the NAT engine. Since no port translation is configured, it performs identity NAT without PAT, which is why option A is correct.
Refer to the exhibit. An ASA is configured with the above access-list and NAT rule. A web server is reachable from the internet via the public IP 203.0.113.10. However, internal users from the inside network cannot access the web server using its public IP address. What is the most likely cause?
Explanation: The NAT rule shown is a static NAT for the web server, but it is missing the 'static' keyword or the bidirectional mapping required for internal users to reach the server using its public IP. Without a proper static NAT (e.g., 'nat (inside,outside) static 192.168.1.10 service tcp www www'), the ASA does not translate the source IP of internal traffic destined to 203.0.113.10 back to the server's private IP, causing the traffic to be dropped or misrouted.
A Cisco ASA is configured with dynamic PAT to translate internal addresses to a single outside IP address. A user on the inside initiates a connection to an external web server. The ASA creates a connection entry. Which table is checked first when a return packet arrives from the web server?
Explanation: The ASA checks the connection table (conn table) first for stateful inspection. The xlate table is used for NAT translation, but connection table is checked for session state.
Which NAT type on a Cisco ASA translates both the source and destination IP addresses and is typically used to allow external hosts to access internal servers?
Explanation: Static NAT creates a one-to-one mapping between an internal private IP and an external public IP, translating both source and destination addresses symmetrically. It is commonly used to make internal servers accessible from the outside.
On a Cisco ASA, which NAT type allows multiple internal hosts to share a single public IP address by using different source ports?
Explanation: PAT (Port Address Translation) or overload uses unique source ports to distinguish sessions from multiple internal hosts sharing one public IP.
+2 more scenario questions available
Practice all NAT and PAT Configuration ScenariosNAT and PAT questions cover static NAT (one-to-one), dynamic NAT (pool-based), and PAT/overload (many-to-one using port numbers). The CCNA asks you to read NAT table output, fix misconfigured NAT, and match the right NAT type to a scenario. These appear throughout the 350-701 and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 350-701. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 350-701 scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full NAT and PAT Configuration Scenarios session with instant scoring and detailed explanations.
Start Scenario Practice →