Question 603 of 1,389
CCNA Network Services and Security Practice Question
A branch router uses PAT for Internet access. Users can browse out, but the administrator wants a specific internal web server to be reachable from outside on a consistent public address. Which design fits that requirement best?
⚠ Common exam trap
A common exam trap is selecting PAT alone to provide external access to an internal server. While PAT efficiently supports many users sharing one public IP for outbound traffic, it does not assign a fixed public IP to any internal host. This means the server’s public identity changes dynamically, preventing reliable inbound connections. Candidates often confuse PAT’s port translation with static IP mapping, overlooking that servers need static NAT for consistent external reachability. Misunderstanding this distinction leads to incorrect answers and design flaws in real networks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use static NAT for the server and PAT for general user outbound traffic.
The best design is to use static NAT for the internal web server while continuing to use PAT for general user outbound access. In plain language, PAT is ideal for many inside users sharing one public address for ordinary outbound traffic, but a server that must be reachable predictably from the outside needs a fixed public identity. Static NAT provides that one-to-one mapping. This is a practical mixed-design scenario. The network can use PAT for user convenience and address conservation while still reserving a stable translation for a server that external clients need to find reliably. The correct answer recognizes that different NAT methods can serve different purposes in the same environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use static NAT for the server and PAT for general user outbound traffic.
Why this is correct
This is correct because static NAT gives the server a fixed public identity while PAT supports many internal users.
- ✗
Use only PAT for everything, including predictable outside server reachability.
Why it's wrong here
This is wrong because PAT does not provide the same stable one-to-one outside identity expected for a published server.
When this WOULD be correct
In a scenario where all devices, including servers, are intended to share a single public IP address for outbound traffic without the need for external access to specific internal servers, using only PAT would be appropriate. For example, a question might ask for a configuration where all internal devices need to access the internet but do not require any inbound connections.
- ✗
Disable NAT entirely because private IPv4 addresses are Internet-routable.
Why it's wrong here
This is wrong because private IPv4 addresses are not Internet-routable.
When this WOULD be correct
In a scenario where a question states that a network is using IPv6, which allows for global addressing without NAT, disabling NAT would be correct to allow direct access to internal servers from the Internet.
- ✗
Use DHCP relay to publish the server externally.
Why it's wrong here
This is wrong because DHCP relay is unrelated to public server reachability.
When this WOULD be correct
If the exam question asked about a scenario where a server needs to receive IP address assignments dynamically from an external DHCP server, and the focus was on ensuring that the server can communicate with clients outside its local network, then using DHCP relay would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use static NAT for the server and PAT for general user outbound traffic.Correct answer▾
Why this is correct
This is correct because static NAT gives the server a fixed public identity while PAT supports many internal users.
✗Use only PAT for everything, including predictable outside server reachability.Wrong answer — click to see why▾
Why this is wrong here
PAT alone cannot provide a predictable one-to-one mapping for inbound traffic to a specific server because it relies on dynamic port translations. Inbound connections initiated from outside would not have a consistent destination IP and port mapping, making the server unreachable from the internet.
★ When this WOULD be the correct answer
In a scenario where all devices, including servers, are intended to share a single public IP address for outbound traffic without the need for external access to specific internal servers, using only PAT would be appropriate. For example, a question might ask for a configuration where all internal devices need to access the internet but do not require any inbound connections.
Why candidates choose this
Students might think PAT can handle all traffic types, including inbound server access, because PAT is commonly used for outbound traffic. They may overlook that PAT does not create a stable public identity for inbound connections without additional configuration like port forwarding.
✗Disable NAT entirely because private IPv4 addresses are Internet-routable.Wrong answer — click to see why▾
Why this is wrong here
Private IPv4 addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are not routable on the public internet. Disabling NAT would prevent any internal device from communicating with external networks, breaking internet access entirely.
★ When this WOULD be the correct answer
In a scenario where a question states that a network is using IPv6, which allows for global addressing without NAT, disabling NAT would be correct to allow direct access to internal servers from the Internet.
Why candidates choose this
Some students may confuse private addresses with public addresses or think that all IPv4 addresses are globally routable. They might also misunderstand the purpose of NAT as optional rather than necessary for private-to-public communication.
✗Use DHCP relay to publish the server externally.Wrong answer — click to see why▾
Why this is wrong here
DHCP relay is used to forward DHCP broadcast messages between clients and servers across different subnets. It has no role in providing public reachability to an internal server or in NAT/PAT configurations.
★ When this WOULD be the correct answer
If the exam question asked about a scenario where a server needs to receive IP address assignments dynamically from an external DHCP server, and the focus was on ensuring that the server can communicate with clients outside its local network, then using DHCP relay would be correct.
Why candidates choose this
Students might associate 'relay' with forwarding traffic or think DHCP relay can somehow expose internal servers externally. The term 'relay' can be misleading, causing confusion with port forwarding or NAT.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.