350-401 NAT and DHCP — 15 Questions

Question 1

A network engineer is configuring a Cisco router to provide internet access to a small office using a single public IP address assigned by the ISP. The engineer wants to allow internal hosts to initiate connections to the internet, but also needs to make a web server on the internal network reachable from the internet. The engineer configures a standard access list for NAT and an ip nat inside source list command. However, external users cannot reach the internal web server. What is the most likely cause?

Accepted Answer

The engineer forgot to add the ip nat inside source static command for the web server.. The scenario requires both dynamic NAT (for outbound traffic) and static NAT (for inbound access to the web server). Using only a dynamic NAT configuration with an access list will not provide a permanent mapping for the web server.

Answer

The access list used for NAT does not permit the web server's IP address.

Answer

The ip nat inside and ip nat outside commands are applied on the wrong interfaces.

Answer

The global configuration mode is missing the ip nat pool command.

Question 2

A network engineer is troubleshooting a DHCP issue on a Cisco router configured as a DHCP server for a VLAN. Clients in the VLAN are able to obtain IP addresses from the DHCP server, but they are not receiving the correct DNS server address. The engineer checks the DHCP pool configuration and sees the dns-server command is configured with the correct IP address. What is the most likely cause of the problem?

Accepted Answer

The DHCP pool is not associated with the correct VLAN interface using the network command.. The DHCP server configuration appears correct, but the clients are not receiving the DNS server address. This often happens when the DHCP server is not the default gateway and DHCP relay is involved, or when the DHCP pool is not bound to the correct interface.

Answer

The DNS server is unreachable from the DHCP server.

Answer

The ip dhcp excluded-address command is blocking the DNS server IP.

Answer

The DHCP client is configured with a static DNS server address.

Question 3

A network engineer is configuring NAT overload (PAT) on a Cisco router to allow multiple internal hosts to share a single public IP address. The engineer uses the command ip nat inside source list 1 interface GigabitEthernet0/0 overload. After testing, internal hosts can access the internet, but some applications fail intermittently. The engineer suspects a NAT issue. What is the most likely cause?

Accepted Answer

The NAT translation table is filling up due to a large number of concurrent sessions, causing new translations to be denied.. PAT uses port numbers to multiplex multiple sessions over a single public IP. If the port range is exhausted or if the NAT translation table is full, new sessions will fail.

Answer

The access list 1 is too permissive and includes the public IP address of the router.

Answer

The router is not configured with ip nat inside on the internal interface.

Answer

The overload keyword is misspelled or not supported on this IOS version.

Question 4

A network engineer is configuring a Cisco router as a DHCP relay agent to forward DHCP requests from a client VLAN to a centralized DHCP server located in a different subnet. The engineer configures the ip helper-address command on the VLAN interface. However, clients in the VLAN are not receiving IP addresses. The DHCP server is reachable from the router. What is the most likely cause?

Accepted Answer

The router does not have a return route to the client subnet, so the DHCP server's reply is dropped.. The ip helper-address command forwards DHCP broadcasts as unicasts to the specified server. If the DHCP server receives the request but the reply cannot be routed back to the client, the client will not get an address. This often happens when the router does not have a route back to the client subnet.

Answer

The ip helper-address command is applied on the wrong interface (e.g., the interface facing the DHCP server).

Answer

The DHCP server is not configured with a scope for the client subnet.

Answer

The DHCP client is using DHCPv6 instead of DHCPv4.

Question 5

A network engineer is troubleshooting a NAT issue where an internal host cannot establish an SSH session to a remote server on the internet. The engineer checks the NAT translations on the border router and sees that the translation for the host's source IP is present. However, the SSH session times out. The engineer also notices that the remote server's IP is not in the NAT translation table. What is the most likely cause?

Accepted Answer

The router is performing NAT only for the source IP, but the return traffic is taking a different path that does not go through the NAT router.. For a successful NAT session, both the outbound and inbound translations must be present. If only the outbound translation exists, the return traffic is not being translated back correctly, possibly due to asymmetric routing or a missing route.

Answer

The SSH server is blocking connections from the public IP address.

Answer

The NAT overload is causing port conflicts for SSH.

Answer

The access list used for NAT is denying the SSH traffic.

Question 6

A network engineer is configuring a Cisco router to act as a DHCP server for a branch office. The engineer creates a DHCP pool for the 192.168.1.0/24 subnet and configures the default-router, dns-server, and domain-name options. However, clients are able to obtain IP addresses but cannot ping the default gateway. The engineer verifies that the router's interface IP is 192.168.1.1. What is the most likely cause?

Accepted Answer

The router's interface is not configured with an IP address in the 192.168.1.0/24 subnet.. The DHCP server assigns the default gateway, but if the router's interface is not in the same subnet as the pool or if the interface is down, clients cannot reach it.

Answer

The DHCP pool is missing the lease command.

Answer

The router's interface is administratively down.

Answer

The ip dhcp excluded-address command is blocking the default gateway IP.

Question 7

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source list 100 interface GigabitEthernet0/0 overload, where access list 100 permits only the 10.0.0.0/8 network. After testing, hosts in the 10.0.0.0/8 network can access the internet, but hosts in the 172.16.0.0/16 network cannot. The engineer verifies that the 172.16.0.0/16 hosts have connectivity to the router. What is the most likely cause?

Accepted Answer

The access list 100 does not permit the 172.16.0.0/16 network.. The access list used in the NAT command determines which inside local addresses are eligible for translation. If the access list does not include the 172.16.0.0/16 network, those hosts will not be translated and will not be able to reach the internet.

Answer

The router's interface GigabitEthernet0/0 is not configured with ip nat outside.

Answer

The 172.16.0.0/16 hosts have a default gateway pointing to a different router.

Answer

The NAT pool is exhausted for the 172.16.0.0/16 network.

Question 8

A network engineer is troubleshooting a DHCP issue where a client is not receiving an IP address from a Cisco router configured as a DHCP server. The engineer checks the DHCP pool configuration and sees that the network command is configured with the correct subnet. The engineer also verifies that the ip dhcp excluded-address command is not blocking any addresses. However, the client's DHCP discover message is not reaching the router. What is the most likely cause?

Accepted Answer

The router's interface is not in the same VLAN as the client, and no ip helper-address is configured.. DHCP uses broadcast messages. If the router's interface is not configured to receive broadcasts (e.g., due to a switched network with VLANs), the DHCP server may not see the client's request. However, the most common issue is that the interface is not configured with the ip dhcp server command or the interface is in a different VLAN without a helper address.

Answer

The router's interface is configured with the no ip forward-protocol udp bootps command.

Answer

The DHCP pool is configured with the wrong default-router option.

Answer

The router's DHCP server is disabled globally with the no service dhcp command.

Question 9

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source static tcp 192.168.1.10 80 203.0.113.1 80. After testing, external users can access the internal web server using the public IP. However, internal hosts cannot access the web server using the public IP. What is the most likely cause?

Accepted Answer

The router does not have NAT hairpinning enabled, so internal traffic to the public IP is not translated.. This is a classic NAT hairpinning issue. When an internal host tries to reach the public IP of the server, the router may not support or be configured for NAT reflection (hairpinning), so the packet is not translated correctly.

Answer

The static NAT entry is missing the extendable keyword.

Answer

The internal hosts have a route to the public IP via the router's outside interface.

Answer

The access list used for NAT is blocking internal traffic.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---

Based on this output, what can be concluded?

Accepted Answer

Static NAT is configured for two internal hosts.. The output shows two static NAT translations with no protocol, indicating they are configured as static NAT entries. The inside global addresses are mapped one-to-one to inside local addresses. No dynamic translations are present.

Answer

Dynamic NAT is configured with a pool of addresses.

Answer

PAT is translating multiple internal addresses to a single global address.

Answer

NAT is not operational because no outside local addresses are shown.

Question 11

A network engineer runs the following command on Router R2:

R2# debug ip dhcp server events
*Mar  1 00:05:23.123: DHCPD: DHCPDISCOVER received from client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 on interface GigabitEthernet0/1
*Mar  1 00:05:23.124: DHCPD: Sending DHCPOFFER to client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 (10.0.0.2)
*Mar  1 00:05:23.125: DHCPD: DHCPREQUEST received from client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30
*Mar  1 00:05:23.126: DHCPD: Sending DHCPACK to client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 (10.0.0.2)

Based on this debug output, what can be concluded?

Accepted Answer

The DHCP server successfully assigned IP address 10.0.0.2 to the client.. The debug shows a successful DHCP four-message exchange (DISCOVER, OFFER, REQUEST, ACK) with the client receiving IP address 10.0.0.2. The client ID is a long hex string derived from the client's MAC address.

Answer

The DHCP server failed to allocate an IP address to the client.

Answer

The client is using DHCPv6 because of the long client ID.

Answer

The DHCP server is configured with a pool that excludes 10.0.0.2.

Question 12

A network engineer runs the following command on Router R3:

R3# show ip nat statistics
Total active translations: 5 (0 static, 5 dynamic; 5 extended)
Outside interfaces: GigabitEthernet0/0
Inside interfaces: GigabitEthernet0/1
Hits: 1234  Misses: 5
CEF Translated packets: 1200, CEF Punted packets: 34
Expired translations: 10
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 203.0.113.1 203.0.113.10 netmask 255.255.255.240
   refcount 5

Based on this output, what can be concluded?

Accepted Answer

The router is performing Port Address Translation (PAT).. The statistics show 5 active dynamic translations, all extended (PAT). The pool POOL1 has 10 addresses, but only 5 are currently used. The misses indicate packets that triggered new translations.

Answer

The NAT pool has exhausted all available addresses.

Answer

The NAT translations are all static.

Answer

The inside interface is GigabitEthernet0/0.

Question 13

A network engineer runs the following command on Router R4:

R4# show ip dhcp binding
Bindings from all pools not associated with VRF:
IP address       Client-ID/              Lease expiration        Type
                 Hardware address/
                 User name
10.0.0.10        0063.6973.636f.2d30.    Mar 01 2025 12:00 PM   Automatic
                 3030.302e.3030.3030.
                 2e30.3030.312d.4574.
                 30
10.0.0.11        0063.6973.636f.2d30.    Mar 01 2025 12:05 PM   Automatic
                 3030.302e.3030.3030.
                 2e30.3030.312d.4574.
                 31

Based on this output, what can be concluded?

Accepted Answer

The DHCP server has two active leases.. The output shows two DHCP bindings with automatic type, meaning they were dynamically assigned. The client-ID is a hex string representing the client identifier. Lease expiration times are shown.

Answer

Both clients have static DHCP reservations.

Answer

The DHCP server is out of addresses.

Answer

The clients are using DHCPv6.

Question 14

A network engineer runs the following command on Router R5:

R5# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.20:1234    10.0.0.20:1234     203.0.113.1:53     203.0.113.1:53
tcp 192.0.2.20:5678    10.0.0.20:5678     198.51.100.1:80    198.51.100.1:80

Based on this output, what can be concluded?

Accepted Answer

The router is performing Port Address Translation (PAT) for multiple sessions from the same internal host.. The output shows two translations using the same inside global address (192.0.2.20) but different ports, which is characteristic of PAT. One translation is UDP (DNS) and one is TCP (HTTP).

Answer

The router is configured with static NAT for two internal hosts.

Answer

The router is performing destination NAT.

Answer

The inside local address 10.0.0.20 is using two different global addresses.

Question 15

A network engineer runs the following command on Router R6:

R6# show ip dhcp conflict
IP address       Detection method     Detection time         VRF
10.0.0.10        Ping                 Mar 01 2025 10:00 AM   default
10.0.0.15        Gratuitous ARP       Mar 01 2025 10:05 AM   default

Based on this output, what can be concluded?

Accepted Answer

The addresses 10.0.0.10 and 10.0.0.15 are unavailable for DHCP assignment.. The output shows two IP address conflicts detected by the DHCP server. One was detected via ping, the other via gratuitous ARP. These addresses are marked as conflicted and will not be assigned until resolved.

Answer

The DHCP server has successfully assigned these addresses to clients.

Answer

The DHCP server uses only ping to detect conflicts.

Answer

The conflicts were caused by the DHCP server itself.