350-401 NAT and DHCP — 10 Questions

Question 1

A network engineer is configuring a Cisco router to provide internet access to a small office using a single public IP address assigned by the ISP. The engineer wants to allow internal hosts to initiate connections to the internet, but also needs to make a web server on the internal network reachable from the internet. The engineer configures a standard access list for NAT and an ip nat inside source list command. However, external users cannot reach the internal web server. What is the most likely cause?

Accepted Answer

The engineer forgot to add the ip nat inside source static command for the web server.. The scenario requires both dynamic NAT (for outbound traffic) and static NAT (for inbound access to the web server). Using only a dynamic NAT configuration with an access list will not provide a permanent mapping for the web server.

Answer

The access list used for NAT does not permit the web server's IP address.

Answer

The ip nat inside and ip nat outside commands are applied on the wrong interfaces.

Answer

The global configuration mode is missing the ip nat pool command.

Question 2

A network engineer is troubleshooting a DHCP issue on a Cisco router configured as a DHCP server for a VLAN. Clients in the VLAN are able to obtain IP addresses from the DHCP server, but they are not receiving the correct DNS server address. The engineer checks the DHCP pool configuration and sees the dns-server command is configured with the correct IP address. What is the most likely cause of the problem?

Accepted Answer

The DHCP pool is not associated with the correct VLAN interface using the network command.. The DHCP server configuration appears correct, but the clients are not receiving the DNS server address. This often happens when the DHCP server is not the default gateway and DHCP relay is involved, or when the DHCP pool is not bound to the correct interface.

Answer

The DNS server is unreachable from the DHCP server.

Answer

The ip dhcp excluded-address command is blocking the DNS server IP.

Answer

The DHCP client is configured with a static DNS server address.

Question 3

A network engineer is configuring NAT overload (PAT) on a Cisco router to allow multiple internal hosts to share a single public IP address. The engineer uses the command ip nat inside source list 1 interface GigabitEthernet0/0 overload. After testing, internal hosts can access the internet, but some applications fail intermittently. The engineer suspects a NAT issue. What is the most likely cause?

Accepted Answer

The NAT translation table is filling up due to a large number of concurrent sessions, causing new translations to be denied.. PAT uses port numbers to multiplex multiple sessions over a single public IP. If the port range is exhausted or if the NAT translation table is full, new sessions will fail.

Answer

The access list 1 is too permissive and includes the public IP address of the router.

Answer

The router is not configured with ip nat inside on the internal interface.

Answer

The overload keyword is misspelled or not supported on this IOS version.

Question 4

A network engineer is configuring a Cisco router as a DHCP relay agent to forward DHCP requests from a client VLAN to a centralized DHCP server located in a different subnet. The engineer configures the ip helper-address command on the VLAN interface. However, clients in the VLAN are not receiving IP addresses. The DHCP server is reachable from the router. What is the most likely cause?

Accepted Answer

The router does not have a return route to the client subnet, so the DHCP server's reply is dropped.. The ip helper-address command forwards DHCP broadcasts as unicasts to the specified server. If the DHCP server receives the request but the reply cannot be routed back to the client, the client will not get an address. This often happens when the router does not have a route back to the client subnet.

Answer

The ip helper-address command is applied on the wrong interface (e.g., the interface facing the DHCP server).

Answer

The DHCP server is not configured with a scope for the client subnet.

Answer

The DHCP client is using DHCPv6 instead of DHCPv4.

Question 5

A network engineer is troubleshooting a NAT issue where an internal host cannot establish an SSH session to a remote server on the internet. The engineer checks the NAT translations on the border router and sees that the translation for the host's source IP is present. However, the SSH session times out. The engineer also notices that the remote server's IP is not in the NAT translation table. What is the most likely cause?

Accepted Answer

The router is performing NAT only for the source IP, but the return traffic is taking a different path that does not go through the NAT router.. For a successful NAT session, both the outbound and inbound translations must be present. If only the outbound translation exists, the return traffic is not being translated back correctly, possibly due to asymmetric routing or a missing route.

Answer

The SSH server is blocking connections from the public IP address.

Answer

The NAT overload is causing port conflicts for SSH.

Answer

The access list used for NAT is denying the SSH traffic.

Question 6

A network engineer is configuring a Cisco router to act as a DHCP server for a branch office. The engineer creates a DHCP pool for the 192.168.1.0/24 subnet and configures the default-router, dns-server, and domain-name options. However, clients are able to obtain IP addresses but cannot ping the default gateway. The engineer verifies that the router's interface IP is 192.168.1.1. What is the most likely cause?

Accepted Answer

The router's interface is not configured with an IP address in the 192.168.1.0/24 subnet.. The DHCP server assigns the default gateway, but if the router's interface is not in the same subnet as the pool or if the interface is down, clients cannot reach it.

Answer

The DHCP pool is missing the lease command.

Answer

The router's interface is administratively down.

Answer

The ip dhcp excluded-address command is blocking the default gateway IP.

Question 7

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source list 100 interface GigabitEthernet0/0 overload, where access list 100 permits only the 10.0.0.0/8 network. After testing, hosts in the 10.0.0.0/8 network can access the internet, but hosts in the 172.16.0.0/16 network cannot. The engineer verifies that the 172.16.0.0/16 hosts have connectivity to the router. What is the most likely cause?

Accepted Answer

The access list 100 does not permit the 172.16.0.0/16 network.. The access list used in the NAT command determines which inside local addresses are eligible for translation. If the access list does not include the 172.16.0.0/16 network, those hosts will not be translated and will not be able to reach the internet.

Answer

The router's interface GigabitEthernet0/0 is not configured with ip nat outside.

Answer

The 172.16.0.0/16 hosts have a default gateway pointing to a different router.

Answer

The NAT pool is exhausted for the 172.16.0.0/16 network.

Question 8

A network engineer is troubleshooting a DHCP issue where a client is not receiving an IP address from a Cisco router configured as a DHCP server. The engineer checks the DHCP pool configuration and sees that the network command is configured with the correct subnet. The engineer also verifies that the ip dhcp excluded-address command is not blocking any addresses. However, the client's DHCP discover message is not reaching the router. What is the most likely cause?

Accepted Answer

The router's interface is not in the same VLAN as the client, and no ip helper-address is configured.. DHCP uses broadcast messages. If the router's interface is not configured to receive broadcasts (e.g., due to a switched network with VLANs), the DHCP server may not see the client's request. However, the most common issue is that the interface is not configured with the ip dhcp server command or the interface is in a different VLAN without a helper address.

Answer

The router's interface is configured with the no ip forward-protocol udp bootps command.

Answer

The DHCP pool is configured with the wrong default-router option.

Answer

The router's DHCP server is disabled globally with the no service dhcp command.

Question 9

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source static tcp 192.168.1.10 80 203.0.113.1 80. After testing, external users can access the internal web server using the public IP. However, internal hosts cannot access the web server using the public IP. What is the most likely cause?

Accepted Answer

The router does not have NAT hairpinning enabled, so internal traffic to the public IP is not translated.. This is a classic NAT hairpinning issue. When an internal host tries to reach the public IP of the server, the router may not support or be configured for NAT reflection (hairpinning), so the packet is not translated correctly.

Answer

The static NAT entry is missing the extendable keyword.

Answer

The internal hosts have a route to the public IP via the router's outside interface.

Answer

The access list used for NAT is blocking internal traffic.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---

Based on this output, what can be concluded?

Accepted Answer

Static NAT is configured for two internal hosts.. The output shows two static NAT translations with no protocol, indicating they are configured as static NAT entries. The inside global addresses are mapped one-to-one to inside local addresses. No dynamic translations are present.

Answer

Dynamic NAT is configured with a pool of addresses.

Answer

PAT is translating multiple internal addresses to a single global address.

Answer

NAT is not operational because no outside local addresses are shown.