300-410 NAT and PAT Practice Test 4 — 15 Questions

Question 1

A network engineer runs the following command to verify NAT on a VRF:

R1# show ip nat translations vrf CUSTOMER
Pro Inside global      Inside local       Outside local      Outside global
--- 10.2.2.2           10.1.1.1           192.168.1.1        192.168.1.1

What is the purpose of the 'vrf CUSTOMER' parameter?

Accepted Answer

It filters translations for a specific VRF, allowing per-customer NAT.. This shows NAT translations specific to a VRF, used in MPLS VPN environments where NAT is applied per VRF.

Answer

It shows all translations across all VRFs.

Answer

It enables NAT on the VRF interface.

Answer

It creates a new VRF for NAT.

Question 2

A network engineer runs the following command to debug NAT with overload:

R1# debug ip nat overload
NAT: overload: s=10.1.1.1:1234->203.0.113.1:5678, d=192.168.1.1:80 [50]
NAT: overload: s=10.1.1.1:1235->203.0.113.1:5679, d=192.168.1.1:80 [51]
NAT: overload: s=10.1.1.2:80->203.0.113.1:5680, d=192.168.1.1:1024 [52]

What does this output indicate?

Accepted Answer

PAT is working correctly, translating multiple inside hosts to one outside IP.. The output shows PAT (overload) translating multiple inside addresses and ports to a single outside address with different ports. This is normal PAT operation.

Answer

NAT is failing because the outside address is the same for all.

Answer

The translations are static.

Answer

The inside hosts are using the same port numbers.

Question 3

A network engineer runs the following command to verify NAT after a fix:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 203.0.113.1        10.1.1.1           192.168.1.1        192.168.1.1
--- 203.0.113.2        10.1.1.2           192.168.1.2        192.168.1.2

What is the most likely configuration?

Accepted Answer

Dynamic NAT without overload, using a pool of addresses.. The output shows two dynamic translations with different inside global addresses, indicating a pool of addresses is used without PAT (overload).

Answer

Static NAT for each host.

Answer

PAT with a single address.

Answer

NAT is not configured.

Question 4

A network engineer runs the following command to debug NAT with route maps:

R1# debug ip nat policy
NAT: policy: match ip address 100
NAT: policy: match ip address 100
NAT: policy: match ip address 100
NAT: policy: route-map RM-NAT permit 10
  match ip address 100
  set ip next-hop 10.0.0.1

What does this output indicate?

Accepted Answer

NAT is using a route map to redirect traffic for translation.. The debug shows that a route map is being used for NAT policy-based routing. The 'set ip next-hop' indicates traffic is being redirected, possibly for NAT purposes.

Answer

The route map is blocking all traffic.

Answer

NAT is not configured.

Answer

The route map is used for routing, not NAT.

Question 5

A network engineer runs the following command to verify NAT on an interface:

R1# show ip nat interface GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up
  NAT: inside, active
  NAT: outside, active
  NAT: overload, active

What is the issue with this configuration?

Accepted Answer

The interface is configured as both inside and outside, which is invalid.. The interface is configured as both inside and outside, which is incorrect. An interface should be either inside or outside, not both.

Answer

The interface is correctly configured for NAT.

Answer

The interface is down.

Answer

Overload is not active.

Question 6

What is the default timeout value for a NAT translation entry that is not using Port Address Translation (PAT) in Cisco IOS?

Accepted Answer

86400 seconds. The default timeout for a basic NAT translation (no PAT) is 86400 seconds (24 hours). This is defined in RFC 2663 and implemented as the default in Cisco IOS.

Answer

60 seconds

Answer

300 seconds

Answer

3600 seconds

Question 7

Which statement accurately describes the behavior of the ip nat inside source static command when configuring static NAT for a single inside host?

Accepted Answer

It creates a permanent mapping that remains in the NAT table until the configuration is removed.. The ip nat inside source static command creates a permanent one-to-one mapping between an inside local IP address and an inside global IP address. This translation is always present in the NAT table and does not time out.

Answer

It dynamically allocates the global address from a pool and removes the entry after an idle timeout.

Answer

It requires the use of an access list to define which traffic is translated.

Answer

It translates only TCP and UDP traffic by default.

Question 8

According to RFC 4787 (NAT Behavioral Requirements for UDP), what is the recommended default timeout for UDP NAT mappings?

Accepted Answer

300 seconds. RFC 4787 recommends a default UDP mapping timeout of 5 minutes (300 seconds). Cisco IOS defaults to this value for UDP NAT translations.

Answer

60 seconds

Answer

600 seconds

Answer

86400 seconds

Question 9

In Cisco IOS, what is the default timeout for TCP NAT translations when the TCP session is idle?

Accepted Answer

86400 seconds. The default TCP NAT translation timeout in Cisco IOS is 86400 seconds (24 hours) when no data is being transferred. However, if the TCP session is established and idle, the timeout is 60 minutes (3600 seconds) after the first packet. The 24-hour value applies to the overall translation entry.

Answer

60 seconds

Answer

300 seconds

Answer

3600 seconds

Question 10

Which of the following is true regarding the default behavior of NAT in Cisco IOS when handling ICMP traffic?

Accepted Answer

ICMP NAT entries timeout after 60 seconds by default.. Cisco IOS NAT translates ICMP traffic by default. ICMP query types (such as echo request/reply) are translated using the ICMP identifier field as a pseudo-port, and the default timeout for ICMP NAT entries is 60 seconds.

Answer

ICMP traffic is not translated by NAT unless explicitly configured.

Answer

ICMP NAT entries use the same timeout as TCP entries by default.

Answer

ICMP NAT entries are permanent and do not time out.

Question 11

In the context of NAT and PAT, what is the purpose of the ip nat translation timeout command?

Accepted Answer

It configures the timeout for all dynamic NAT translations globally.. The ip nat translation timeout command globally modifies the timeout value for dynamic NAT translations. It affects all protocols unless overridden by protocol-specific timers (e.g., ip nat translation udp-timeout).

Answer

It sets the timeout for static NAT entries.

Answer

It sets the timeout only for TCP translations.

Answer

It configures the timeout for translations on a specific interface.

Question 12

Which of the following is a limitation of NAT as defined in RFC 2663?

Accepted Answer

NAT breaks end-to-end IP connectivity and can interfere with application-layer protocols.. RFC 2663 describes NAT and its limitations. One key limitation is that NAT breaks end-to-end IP connectivity because it modifies IP addresses and possibly port numbers in packets, which can interfere with protocols that embed IP addresses in the payload (e.g., FTP, SIP).

Answer

NAT cannot translate UDP traffic.

Answer

NAT is incompatible with TCP traffic.

Answer

NAT requires all traffic to be encrypted.

Question 13

In Cisco IOS, what is the default behavior of the ip nat service command?

Accepted Answer

It is used to configure NAT for specific application-layer protocols and is not enabled by default.. The ip nat service command is used to enable or disable NAT for specific protocols or to change the port number used for NAT. By default, NAT is enabled for all protocols. The command is often used to adjust NAT behavior for protocols like SIP or H.323.

Answer

It disables NAT for all protocols by default.

Answer

It enables NAT only for TCP and UDP by default.

Answer

It configures the NAT translation timeout for all services.

Question 14

What is the default maximum number of NAT translations that can be created in Cisco IOS?

Accepted Answer

Unlimited, limited only by available memory. Cisco IOS does not have a fixed default maximum number of NAT translations; it is limited by available memory. However, the ip nat translation max-entries command can be used to set a limit. Without configuration, the limit is dynamic based on system resources.

Answer

512 translations

Answer

1024 translations

Answer

4096 translations

Question 15

Drag and drop the steps to configure PAT (overload) for dynamic source NAT into the correct order, from first to last.

Accepted Answer

Configure an access list to match inside local addresses. The correct order follows the standard Cisco IOS-XE configuration sequence: first define an access list to match interesting traffic, then create a NAT pool (if needed), then configure dynamic source translation with overload, then apply the configuration to the inside interface, and finally apply it to the outside interface.