300-410 NAT and PAT Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---
--- 192.0.2.12         10.0.0.12          ---                ---
--- 192.0.2.13         10.0.0.13          ---                ---
--- 192.0.2.14         10.0.0.14          ---                ---
--- 192.0.2.15         10.0.0.15          ---                ---
--- 192.0.2.16         10.0.0.16          ---                ---
--- 192.0.2.17         10.0.0.17          ---                ---
--- 192.0.2.18         10.0.0.18          ---                ---
--- 192.0.2.19         10.0.0.19          ---                ---
--- 192.0.2.20         10.0.0.20          ---                ---

R1# show ip nat statistics
Total active translations: 11 (0 static, 11 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 200  Misses: 0
CEF Translated packets: 200, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 11
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 11

Based on this output, what is the problem?

Accepted Answer

The NAT pool is exhausted; no addresses are available for new translations.. The output shows 11 dynamic translations using all 11 addresses in the pool (192.0.2.10–192.0.2.20 inclusive = 11 addresses). The pool is fully utilized. If a new inside host attempts to communicate, it will fail because no addresses are available. This is a problem because the pool is exhausted.

Answer

PAT is not configured, causing address exhaustion.

Answer

The inside and outside interfaces are misconfigured.

Answer

Static NAT is conflicting with dynamic NAT.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---

R1# show ip nat statistics
Total active translations: 1 (0 static, 1 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 0  Misses: 0
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 1
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 1

Based on this output, what is the problem?

Accepted Answer

The NAT translation exists but no traffic is being translated (0 hits, 0 misses), indicating a possible idle translation or no matching traffic.. The output shows 1 dynamic translation but 0 hits and 0 misses. This indicates that a translation entry exists (perhaps from a previous session or manual creation), but no packets have been translated. The 0 hits and 0 misses suggest that no traffic is flowing through the NAT. This could be due to the translation being stale or no traffic matching the ACL.

Answer

The NAT pool is exhausted.

Answer

PAT is misconfigured.

Answer

The inside and outside interfaces are reversed.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.10:10000   10.0.0.10:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10001   10.0.0.11:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10002   10.0.0.12:10000    203.0.113.5:53    203.0.113.5:53

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 150  Misses: 0
CEF Translated packets: 150, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload
   refcount 3

Based on this output, which statement is correct?

Accepted Answer

PAT is working correctly; multiple inside hosts share the same global address with unique ports.. The output shows three PAT translations using the interface address (192.0.2.10) with unique source ports (10000, 10001, 10002). This is correct PAT operation. The statistics show hits and no misses, indicating proper function.

Answer

The NAT pool is exhausted because all addresses are used.

Answer

Static NAT is configured for DNS traffic.

Answer

The inside and outside interfaces are swapped.

Question 4

Consider the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect of this configuration?

Accepted Answer

All traffic from 192.168.1.0/24 is translated to 203.0.113.1 using PAT.. The configuration enables NAT overload (PAT) for the 192.168.1.0/24 network, translating all inside addresses to the IP of GigabitEthernet0/1 (203.0.113.1) with port multiplexing.

Answer

Only traffic from 192.168.1.1 is translated to 203.0.113.1 using PAT.

Answer

Traffic is translated using static NAT to 203.0.113.1.

Answer

The configuration is incomplete; a NAT pool is required for dynamic translation.

Question 5

Given this partial configuration:

ip nat pool MYPOOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool MYPOOL
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect?

Accepted Answer

Inside hosts are dynamically mapped to a pool address; if the pool is exhausted, new translations fail.. This configures dynamic NAT without overload, so translations are one-to-one from inside addresses to the pool. If more inside hosts than pool addresses try to communicate, some will fail.

Answer

Inside hosts are translated to addresses in the pool using PAT.

Answer

The router uses the pool address as the source for all outbound traffic, regardless of ACL.

Answer

This configuration requires the 'ip nat outside' interface command to function.

Question 6

Examine this configuration:

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.0
 ip nat outside
!
ip nat inside source static tcp 10.0.0.10 80 198.51.100.10 8080 extendable

Which statement is true?

Accepted Answer

Incoming traffic to 198.51.100.10:8080 is forwarded to 10.0.0.10:80.. This is a static NAT for TCP port 80 on inside host 10.0.0.10 to outside address 198.51.100.10 port 8080. The 'extendable' keyword allows multiple static translations to the same outside IP.

Answer

All traffic from 10.0.0.10 is translated to 198.51.100.10.

Answer

The 'extendable' keyword is invalid for static NAT.

Answer

This translation will not work unless 'ip nat inside source list' is also configured.

Question 7

What is the problem with this NAT configuration?

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

Accepted Answer

The interface GigabitEthernet0/1 is missing the 'ip nat outside' command.. The outside interface (GigabitEthernet0/1) is missing the 'ip nat outside' command, which is required for NAT to function.

Answer

The ACL is too permissive; it should only permit specific hosts.

Answer

The 'overload' keyword is unnecessary for this configuration.

Answer

The inside interface should be GigabitEthernet0/1.

Question 8

Given this configuration:

ip nat pool GLOBAL 203.0.113.1 203.0.113.10 prefix-length 28
ip nat inside source list 10 pool GLOBAL overload
access-list 10 permit 10.0.0.0 0.255.255.255

What is the effect?

Accepted Answer

Inside hosts matching ACL 10 are translated to addresses in the pool using PAT.. This uses a pool of addresses with PAT (overload). Inside hosts matching ACL 10 are translated to one of the pool addresses with port multiplexing.

Answer

All inside hosts are translated to the first pool address only.

Answer

Each inside host gets a unique pool address without port translation.

Answer

The prefix-length 28 is invalid; a netmask must be used instead.

Question 9

Consider this partial configuration:

ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/2
 ip address 172.16.0.1 255.255.255.0
 ip nat inside

What is true about traffic from the 172.16.0.0/24 network?

Accepted Answer

It is not translated and will be forwarded with its original source IP.. The ACL (access-list 1) only permits 192.168.1.0/24. Traffic from 172.16.0.0/24 is not matched and therefore not translated.

Answer

It is translated using PAT to 203.0.113.1.

Answer

It is dropped because NAT is required for all inside interfaces.

Answer

It is translated using a different pool because it is on a separate inside interface.

Question 10

What is the default timeout for NAT translation entries in Cisco IOS?

Accepted Answer

86400 seconds (24 hours). The default timeout for dynamic NAT translations is 24 hours (86400 seconds). This can be changed with the 'ip nat translation timeout' command.

Answer

60 seconds

Answer

300 seconds

Answer

Never expires

Question 11

Which TCP flag combination triggers the NAT translation timeout to change from the default to the 'ip nat translation tcp-timeout' value?

Accepted Answer

FIN or RST. When a TCP connection is closed, the FIN or RST flag causes the NAT entry to use the shorter tcp-timeout (default 60 seconds) instead of the general timeout.

Answer

SYN

Answer

ACK

Answer

URG

Question 12

According to RFC 2663, what is the term for the process of translating both the source and destination IP addresses in a packet?

Accepted Answer

Twice NAT. RFC 2663 defines 'Twice NAT' as the process where both source and destination addresses are translated, typically used when address spaces overlap.

Answer

Static NAT

Answer

PAT

Answer

Double NAT

Question 13

Which TWO commands would a network engineer use to verify NAT translations and their statistics on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show ip nat translations. The show ip nat translations command displays active NAT/PAT translation entries, while show ip nat statistics provides counters and configuration details. The other commands either do not exist or serve different purposes.

Answer

show ip nat verbose

Answer

show running-config | include nat

Answer

debug ip nat

Question 14

Which TWO statements about NAT overload (PAT) are true? (Choose TWO.)

Accepted Answer

PAT allows multiple inside hosts to share a single public IP address by using unique source port numbers.. PAT uses port numbers to multiplex multiple inside hosts to a single public IP, and it is commonly used to conserve public IPv4 addresses. PAT can also be used with a pool of addresses, not just a single interface IP.

Answer

PAT is only supported with a single public IP address configured on the outside interface.

Answer

PAT cannot translate traffic for protocols that use static port numbers, such as DNS or HTTP.

Answer

PAT requires the ip nat inside source list command with the overload keyword.

Question 15

Which TWO configuration steps are required to implement static NAT on a Cisco IOS router? (Choose TWO.)

Accepted Answer

Configure ip nat inside source static

in global configuration mode.. Static NAT requires defining a one-to-one mapping between inside local and inside global addresses, and then applying the ip nat inside and ip nat outside commands on the respective interfaces.

Answer

Apply the ip nat outside command on the interface facing the internal network.

Answer

Configure an access list to match the inside local addresses for translation.

Answer

Enable the ip nat service command globally to activate NAT.