NAT and PAT questions cover static NAT (one-to-one), dynamic NAT (pool-based), and PAT/overload (many-to-one using port numbers). The CCNA asks you to read NAT table output, fix misconfigured NAT, and match the right NAT type to a scenario.
Start Scenario PracticeWhen you have multiple overlapping NAT rules, which rule is applied?
Explanation: The FTD matches NAT rules using a top-down approach, similar to Access Control rules.
A network engineer needs to configure Auto NAT on a Firepower Threat Defense device managed by FMC to translate internal subnet 10.10.10.0/24 to a single public IP address 203.0.113.50. Which translation type should be selected?
Explanation: Dynamic PAT (Port Address Translation) is the correct choice because it translates multiple internal IP addresses to a single public IP address using unique source ports. This allows the entire 10.10.10.0/24 subnet to share one public IP, which is the typical use case for PAT. Static NAT would require a one-to-one mapping, and Dynamic NAT would require a pool of public IPs.
An administrator is troubleshooting an FTD device that is failing to register with FMC. The FTD has been configured with the correct FMC IP address, registration key, and NAT ID. Which additional setting must be verified on the FTD to allow successful registration?
Explanation: The FTD requires a route to reach FMC. If FMC is on a different network, a default gateway or static route must be configured on the management interface. Without it, registration packets cannot reach FMC. DNS, time zone, and NAT ID are either already addressed or not blocking registration in this scenario.
An administrator wants to ensure that specific internal subnets are never subjected to NAT translation when communicating with a partner VPN tunnel. Which NAT feature achieves this?
Explanation: Identity NAT (also called NAT exemption or 'no NAT') is the feature that explicitly excludes specified source/destination subnet pairs from translation. In Cisco FTD/FMC, an Identity NAT rule is placed in the manual NAT policy with the original source and destination as both the translated source and destination, effectively creating a 'do not translate' entry. This is the standard method for ensuring VPN traffic to a partner tunnel traverses without address rewriting, which is required for IPsec/ISAKMP selectors to match correctly.
An administrator configures DNS injection and rewriting in a manual NAT rule on an FTD device. What is the primary purpose of enabling DNS translation in a NAT rule?
Explanation: DNS translation (DNS injection and rewriting) in a manual NAT rule rewrites DNS A-records in DNS responses so that when an internal server's DNS reply contains a private IP, external clients receive the corresponding public NAT IP instead. This ensures clients connect to the correct translated address.
+10 more scenario questions available
Practice all NAT and PAT Configuration ScenariosNAT and PAT questions cover static NAT (one-to-one), dynamic NAT (pool-based), and PAT/overload (many-to-one using port numbers). The CCNA asks you to read NAT table output, fix misconfigured NAT, and match the right NAT type to a scenario. These appear throughout the 300-710 SNCF and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 300-710 SNCF. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 300-710 SNCF scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full NAT and PAT Configuration Scenarios session with instant scoring and detailed explanations.
Start Scenario Practice →