CCNA Network Services and Security Practice Question
A company wants an internal web server to be reachable consistently from the Internet using one known public IPv4 address. Which NAT approach best fits that requirement?
⚠ Common exam trap
A frequent exam trap is selecting PAT overload as the solution for making an internal server reachable from the Internet. PAT is primarily designed for outbound traffic from multiple internal hosts sharing a single public IP, not for inbound access to a specific server. Another trap is thinking private IPv4 addresses are publicly routable, which they are not, so no NAT would fail to provide Internet reachability. Also, confusing DHCP relay with NAT functions can mislead candidates, as DHCP relay only forwards DHCP messages and does not affect public IP mappings or server accessibility from the Internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static NAT
Static NAT is the best fit because it creates a fixed one-to-one relationship between the inside server and the public address. In practical terms, outside clients need a stable public identity for the server. They cannot rely on a translated address that changes session by session. Static NAT gives that predictability. This is different from PAT, which is designed for many inside users sharing fewer public addresses for outbound traffic. The question is about publishing a server, not conserving addresses for client browsing. That is why static NAT is the strongest answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Static NAT
Why this is correct
This is correct because static NAT gives the server a permanent public mapping.
- ✗
PAT overload
Why it's wrong here
This is wrong because PAT is mainly used for many outbound users sharing fewer public addresses.
When this WOULD be correct
If the question specified a scenario where multiple internal devices needed to access the Internet using a single public IP address without requiring consistent external access to a specific internal server, then PAT overload would be the correct choice.
- ✗
No NAT, because private IPv4 addresses are publicly routable
Why it's wrong here
This is wrong because private IPv4 addresses are not routable on the public Internet.
When this WOULD be correct
In a scenario where the question states that the company has transitioned to using a new IPv6 addressing scheme that allows private addresses to be publicly routable, this option could be correct. The question might specify that the internal web server uses a public IPv6 address, eliminating the need for NAT.
- ✗
DHCP relay
Why it's wrong here
This is wrong because DHCP relay is unrelated to public reachability of an internal server.
When this WOULD be correct
If the question asked about the need to forward DHCP requests from clients on a different subnet to a DHCP server, then DHCP relay would be the correct answer. This scenario would involve configuring a network where clients cannot directly reach the DHCP server due to subnetting.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Static NATCorrect answer▾
Why this is correct
This is correct because static NAT gives the server a permanent public mapping.
✗PAT overloadWrong answer — click to see why▾
Why this is wrong here
PAT overload allows multiple internal devices to share a single public IP address, but it does not provide a consistent mapping for an internal web server to be reachable from the Internet. This means that the server's address could change, making it unreliable for external access.
★ When this WOULD be the correct answer
If the question specified a scenario where multiple internal devices needed to access the Internet using a single public IP address without requiring consistent external access to a specific internal server, then PAT overload would be the correct choice.
Why candidates choose this
Candidates may choose this option because they understand that PAT allows for efficient use of IP addresses and might mistakenly believe it can also provide consistent access to a specific server.
✗No NAT, because private IPv4 addresses are publicly routableWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because private IPv4 addresses are not routable on the public Internet, making it impossible for an internal web server using a private address to be consistently reachable from the Internet without NAT.
★ When this WOULD be the correct answer
In a scenario where the question states that the company has transitioned to using a new IPv6 addressing scheme that allows private addresses to be publicly routable, this option could be correct. The question might specify that the internal web server uses a public IPv6 address, eliminating the need for NAT.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of private and public IP address functionality, believing that private addresses can be used directly on the Internet without realizing the necessity of NAT for such configurations.
✗DHCP relayWrong answer — click to see why▾
Why this is wrong here
DHCP relay is not relevant to the requirement of making an internal web server reachable from the Internet using a public IP address. It is used for forwarding DHCP requests and responses, not for NAT configurations.
★ When this WOULD be the correct answer
If the question asked about the need to forward DHCP requests from clients on a different subnet to a DHCP server, then DHCP relay would be the correct answer. This scenario would involve configuring a network where clients cannot directly reach the DHCP server due to subnetting.
Why candidates choose this
Candidates may confuse DHCP relay with NAT concepts, thinking that it relates to making services accessible over the Internet, leading them to select it based on a misunderstanding of its purpose in network configurations.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
Key term
Internet Protocol
Internet Protocol (IP) is the set of rules that governs how data is addressed, routed, and sent from one device to another across networks, including the internet.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.