CCNA Network Services and Security Practice Question
A company wants a server on the inside network to be reachable consistently from outside using one known public IP address. Which NAT approach best fits that goal?
⚠ Common exam trap
A frequent exam trap is selecting PAT overload as the solution for making an internal server reachable from outside. PAT is designed for multiple internal clients to share a single public IP for outbound connections, not for providing a fixed public IP to a server. Another common mistake is thinking private IP addresses can be accessed directly from the Internet without NAT, which is incorrect because private IPs are non-routable externally. Misunderstanding DHCP relay as related to NAT or public reachability is also a trap; DHCP relay only forwards DHCP requests and does not affect NAT mappings or external accessibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static NAT
Static NAT best fits that goal because it creates a fixed, predictable one-to-one mapping between the internal server and a public address. In plain language, outside systems always know which public IP represents that server. This predictability is exactly what is needed when a service must be reachable consistently from the outside. PAT is better suited for many outbound clients sharing one address, not for presenting one inside server with a permanent public identity. Dynamic NAT from a pool can also vary depending on design. The correct answer is the one that provides the most stable and direct one-to-one mapping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Static NAT
Why this is correct
Static NAT establishes a permanent one-to-one mapping between an inside private IPv4 address and an inside global public IPv4 address. Because the binding is fixed, inbound packets arriving at the public address are always translated to the same internal host, making the server reliably reachable from the Internet. This determinism is exactly why a company would choose static NAT for a server that must be accessible without session-specific state.
- ✗
PAT overload only
Why it's wrong here
PAT overload, also known as NAT overload, maps many inside hosts to a single public IPv4 address by tracking unique source port numbers. This dynamic translation is created only when an inside device initiates an outgoing session, so unsolicited inbound connection attempts directed at that public address have no preexisting binding. Without a static forward rule, an outside host cannot initiate a connection to an internal server through PAT, making it unsuitable for the stated requirement.
When this WOULD be correct
In a question where the requirement is to allow multiple internal servers to access the Internet using a single public IP address without needing consistent external access to any specific server, PAT overload would be the correct choice.
- ✗
No NAT at all, because private IPv4 addresses are Internet-routable
Why it's wrong here
The premise that private IPv4 addresses are Internet-routable is false: RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) are explicitly non-routable across the public Internet, and service providers drop packets using them. Consequently, a server holding only a private address would never receive direct inbound traffic from the outside world. This makes the 'no NAT' option incorrect because the design goal of reachability cannot be achieved without some form of address translation.
When this WOULD be correct
In a scenario where a question asks about a network setup that uses only public IP addresses throughout, and the focus is on internal routing without the need for NAT, then this option could be correct. For example, a question might specify a fully public IPv6 network where NAT is unnecessary.
- ✗
DHCP relay
Why it's wrong here
DHCP relay is a Layer 3 feature that forwards DHCP client broadcast messages to a DHCP server on a different subnet or VLAN, helping clients obtain IP configuration such as addresses and lease times. It performs no address translation and creates no mapping for inbound public traffic; it operates at the application layer of the DHCP protocol and does not affect IP routing reachability. Therefore, configuring DHCP relay would have zero impact on making an internal server reachable from the Internet, making it irrelevant to the requirement.
When this WOULD be correct
If the question asked about enabling DHCP functionality for devices on a network that require IP address assignment from a remote DHCP server, then DHCP relay would be the correct answer, as it facilitates the communication necessary for DHCP in such scenarios.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Static NATCorrect answer▾
Why this is correct
Static NAT establishes a permanent one-to-one mapping between an inside private IPv4 address and an inside global public IPv4 address. Because the binding is fixed, inbound packets arriving at the public address are always translated to the same internal host, making the server reliably reachable from the Internet. This determinism is exactly why a company would choose static NAT for a server that must be accessible without session-specific state.
✗PAT overload onlyWrong answer — click to see why▾
Why this is wrong here
PAT overload allows multiple internal devices to share a single public IP address, but it does not provide a consistent mapping for a specific internal server, which is required in this scenario.
★ When this WOULD be the correct answer
In a question where the requirement is to allow multiple internal servers to access the Internet using a single public IP address without needing consistent external access to any specific server, PAT overload would be the correct choice.
Why candidates choose this
Candidates may confuse PAT overload with static NAT, thinking that since it allows multiple connections, it could also provide consistent external access, leading them to select this option incorrectly.
✗No NAT at all, because private IPv4 addresses are Internet-routableWrong answer — click to see why▾
Why this is wrong here
Private IPv4 addresses are not routable on the Internet; they require NAT to communicate externally. Therefore, stating that no NAT is needed contradicts the requirement for consistent external reachability using a public IP address.
★ When this WOULD be the correct answer
In a scenario where a question asks about a network setup that uses only public IP addresses throughout, and the focus is on internal routing without the need for NAT, then this option could be correct. For example, a question might specify a fully public IPv6 network where NAT is unnecessary.
Why candidates choose this
Candidates may be tempted by this option due to a misunderstanding of private versus public IP address functionality, leading them to incorrectly assume that private addresses can be used directly for external access.
✗DHCP relayWrong answer — click to see why▾
Why this is wrong here
DHCP relay is not relevant to the goal of making a server reachable from outside using a consistent public IP address. It is used to forward DHCP requests from clients to a DHCP server, not for NAT purposes.
★ When this WOULD be the correct answer
If the question asked about enabling DHCP functionality for devices on a network that require IP address assignment from a remote DHCP server, then DHCP relay would be the correct answer, as it facilitates the communication necessary for DHCP in such scenarios.
Why candidates choose this
Candidates may confuse DHCP relay with NAT concepts, thinking that it could somehow assist in making internal servers accessible externally, due to a lack of clarity on the distinct roles of NAT and DHCP in network configurations.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Dynamic NAT
Dynamic NAT is a method of mapping multiple private IP addresses to a pool of public IP addresses automatically, allowing many devices to share a limited number of public addresses.
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.