CCNA Network Services and Security Practice Question
A router performing PAT is using a single public IPv4 address for many inside hosts. Which value most often distinguishes one inside flow from another on the same outside address?
⚠ Common exam trap
A common exam trap is selecting TTL or DSCP as the distinguishing value for inside flows in PAT. TTL is often mistaken because it changes during routing, but it does not uniquely identify sessions. DSCP is related to Quality of Service and does not influence NAT translations. Another trap is thinking MAC addresses can be used to differentiate flows; however, MAC addresses are stripped and replaced at each routed hop, so they are irrelevant in PAT. The correct distinguishing factor is the TCP or UDP source port number, which PAT uses to multiplex multiple inside hosts over a single public IP address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP or UDP source port
PAT commonly multiplexes sessions by translating Layer 4 source port numbers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
TTL
Why it's wrong here
TTL (Time To Live) is an 8-bit field in the IP header that limits a packet's lifetime by counting hops through routers; each router decrements it by one. While every host might start with a common initial TTL (e.g., 64 or 128), the value decreases as the packet crosses the network and is then further modified by the NAT device itself. Because TTL is neither unique to a flow nor consistent across different paths, it cannot serve as a key for distinguishing among multiple internal hosts sharing one public IP.
When this WOULD be correct
In a different question, if it asked about identifying the characteristics of packets in a network where multiple packets from the same source IP are being analyzed, TTL could be relevant in discussing how long packets remain valid in the network before being discarded.
- ✗
DSCP
Why it's wrong here
DSCP (Differentiated Services Code Point) is a 6-bit field in the IP header used for Quality of Service (QoS) classification and per-hop behavior, such as prioritizing voice or video traffic. It does not identify individual flows or internal hosts, because many unrelated packets can carry the same DSCP value, and the field is not unique or dynamic per connection. PAT ignores DSCP entirely and relies solely on transport-layer port numbers to demultiplex translations.
When this WOULD be correct
In a scenario where the question asks about traffic management and prioritization for Quality of Service (QoS) in a network, DSCP could be the correct answer if the focus is on how packets are treated based on their DSCP values rather than on NAT or PAT operations.
- ✓
TCP or UDP source port
Why this is correct
PAT (Port Address Translation) multiplexes many internal hosts onto a single public IPv4 address by rewriting the transport-layer source port. Each active flow is uniquely identified by the combination of the public IP, the source port, and the destination IP/port, allowing the router to reverse the translation and deliver return traffic to the correct internal host. Without port differentiation, all internal hosts would appear as the same IP with no way to distinguish their connections.
- ✗
MAC address of the host
Why it's wrong here
MAC addresses are Layer 2 identifiers that are used only within a single broadcast domain, and they are stripped and replaced by router interfaces as a packet is routed across the network. When a packet arrives at the router performing PAT, the source MAC address is that of the previous-hop router or the PC's default gateway, not the original host's MAC. Furthermore, MAC addresses are not globally unique and cannot be used to demultiplex flows, since the NAT router only sees Layer 3 and Layer 4 information after the Layer 2 header is removed.
When this WOULD be correct
In a question focused on local area network (LAN) segmentation or device identification, where MAC addresses are relevant for distinguishing devices within the same subnet, this option would be correct. For example, a question might ask which identifier is used to manage traffic within a switched network environment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓TCP or UDP source portCorrect answer▾
Why this is correct
PAT (Port Address Translation) multiplexes many internal hosts onto a single public IPv4 address by rewriting the transport-layer source port. Each active flow is uniquely identified by the combination of the public IP, the source port, and the destination IP/port, allowing the router to reverse the translation and deliver return traffic to the correct internal host. Without port differentiation, all internal hosts would appear as the same IP with no way to distinguish their connections.
✗TTLWrong answer — click to see why▾
Why this is wrong here
TTL (Time to Live) is a field in the IP header that determines the lifespan of a packet in the network, but it does not distinguish between different flows of traffic from the same source IP address in NAT or PAT scenarios.
★ When this WOULD be the correct answer
In a different question, if it asked about identifying the characteristics of packets in a network where multiple packets from the same source IP are being analyzed, TTL could be relevant in discussing how long packets remain valid in the network before being discarded.
Why candidates choose this
Candidates may confuse TTL with flow identification due to its role in routing and packet management, mistakenly believing it could serve as a unique identifier for different sessions or flows.
✗DSCPWrong answer — click to see why▾
Why this is wrong here
DSCP (Differentiated Services Code Point) is used for traffic classification and prioritization in IP networks, but it does not distinguish between different flows when multiple inside hosts share a single public IP address in PAT. It is not involved in the mapping of internal to external addresses.
★ When this WOULD be the correct answer
In a scenario where the question asks about traffic management and prioritization for Quality of Service (QoS) in a network, DSCP could be the correct answer if the focus is on how packets are treated based on their DSCP values rather than on NAT or PAT operations.
Why candidates choose this
Candidates may confuse DSCP with flow identification due to its role in managing traffic and might mistakenly believe it plays a part in distinguishing flows in NAT scenarios, leading to the selection of this option.
✗MAC address of the hostWrong answer — click to see why▾
Why this is wrong here
The MAC address operates at Layer 2 of the OSI model and is not used in the context of PAT, which operates at Layer 3 and above. Therefore, MAC addresses do not distinguish between flows on a single public IP address in NAT scenarios.
★ When this WOULD be the correct answer
In a question focused on local area network (LAN) segmentation or device identification, where MAC addresses are relevant for distinguishing devices within the same subnet, this option would be correct. For example, a question might ask which identifier is used to manage traffic within a switched network environment.
Why candidates choose this
Candidates may be tempted to choose this option because they associate MAC addresses with unique device identification, leading them to mistakenly believe it applies to traffic management in NAT scenarios.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
IPv4 address
An IPv4 address is a unique 32-bit numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Internet Protocol
Internet Protocol (IP) is the set of rules that governs how data is addressed, routed, and sent from one device to another across networks, including the internet.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.