CCNA Network Services and Security Practice Question
An engineer configures NAT overload on a router for inside users. Which resource is primarily used to let many internal hosts share one public IPv4 address?
⚠ Common exam trap
Don't confuse static or dynamic NAT with PAT; only PAT allows multiple hosts to share a single IP using port numbers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP and UDP port numbers
PAT distinguishes sessions by using Layer 4 port numbers. That is what allows many inside devices to use the same outside IP address at the same time without conflicting with each other.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IPv6 extension headers
Why it's wrong here
IPv6 extension headers are part of the IPv6 packet format and have no role in IPv4 NAT overload. PAT operates on IPv4 packets and modifies the IP address and transport-layer port field in the TCP/UDP header; it does not parse, insert, or rely on IPv6 extension headers. Since the scenario configures NAT overload on a router for inside IPv4 hosts, IPv6 extension headers are entirely irrelevant to the translation process.
When this WOULD be correct
In a question asking about the benefits of IPv6 over IPv4, specifically regarding how IPv6 handles multiple connections without the need for NAT, an option about IPv6 extension headers could be correct. For instance, if the question focused on how IPv6 improves address space management and connection handling.
- ✓
TCP and UDP port numbers
Why this is correct
NAT overload, also known as Port Address Translation (PAT), multiplexes thousands of inside private IP addresses onto a single public IPv4 address by tracking the Layer 4 TCP or UDP source port number. Each active session is uniquely identified by the combination of destination address/port and the translated source address/port, allowing the router to reverse the translation correctly when returning traffic arrives.
- ✗
Different source MAC addresses on the WAN
Why it's wrong here
NAT overload does not use source MAC addresses on the WAN to differentiate sessions because MAC addresses are Layer 2 addresses that are stripped and rewritten at each router hop. The router forwards all translated packets out the WAN interface using the interface's own MAC address as the source, so different inside clients share the same source MAC. Distinguishing sessions requires the Network Address Translation table entries based on IP addresses and TCP/UDP ports, not the Layer 2 addressing.
When this WOULD be correct
In a scenario where the question asks about how to distinguish between multiple devices on a network segment using MAC addresses, such as in a discussion about VLANs or Ethernet switching, this option could be correct. For example, a question could ask how a switch manages traffic from multiple devices on the same subnet.
- ✗
Separate routing tables per client
Why it's wrong here
NAT overload has no mechanism that creates or maintains separate routing tables per client. A router performing PAT uses a single global routing table and an address translation table that maps inside local addresses and ports to the outside global address and unique port. Maintaining per-client routing tables would be a full routing protocol feature, not a translation function, and it is not how overload distinguishes concurrent sessions.
When this WOULD be correct
In a question where the focus is on advanced routing techniques for isolating traffic from different clients, such as in a multi-tenant environment, the option could be correct if it specifies that separate routing tables are used to manage distinct traffic flows for each client without overlap.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓TCP and UDP port numbersCorrect answer▾
Why this is correct
NAT overload, also known as Port Address Translation (PAT), multiplexes thousands of inside private IP addresses onto a single public IPv4 address by tracking the Layer 4 TCP or UDP source port number. Each active session is uniquely identified by the combination of destination address/port and the translated source address/port, allowing the router to reverse the translation correctly when returning traffic arrives.
✗IPv6 extension headersWrong answer — click to see why▾
Why this is wrong here
IPv6 extension headers are used for additional functionality in IPv6 packets, such as fragmentation or security, and are not involved in NAT overload (PAT) which operates at Layer 4 using port numbers.
★ When this WOULD be the correct answer
In a question asking about the benefits of IPv6 over IPv4, specifically regarding how IPv6 handles multiple connections without the need for NAT, an option about IPv6 extension headers could be correct. For instance, if the question focused on how IPv6 improves address space management and connection handling.
Why candidates choose this
Students might confuse extension headers with the concept of 'extending' address translation, but they are unrelated to port-based multiplexing.
✗Different source MAC addresses on the WANWrong answer — click to see why▾
Why this is wrong here
Source MAC addresses are used for Layer 2 forwarding within a local network and are not preserved across a router's WAN interface; NAT operates at Layer 3 and above, not using MAC addresses for translation.
★ When this WOULD be the correct answer
In a scenario where the question asks about how to distinguish between multiple devices on a network segment using MAC addresses, such as in a discussion about VLANs or Ethernet switching, this option could be correct. For example, a question could ask how a switch manages traffic from multiple devices on the same subnet.
Why candidates choose this
Students may think that different MAC addresses could help identify hosts, but MAC addresses are stripped when packets leave the local subnet and are not used in NAT overload.
✗Separate routing tables per clientWrong answer — click to see why▾
Why this is wrong here
Routers do not maintain separate routing tables per client; routing tables are based on destination networks, not individual hosts. NAT overload uses a single routing table and relies on port numbers for translation.
★ When this WOULD be the correct answer
In a question where the focus is on advanced routing techniques for isolating traffic from different clients, such as in a multi-tenant environment, the option could be correct if it specifies that separate routing tables are used to manage distinct traffic flows for each client without overlap.
Why candidates choose this
The idea of per-client tables might seem logical for tracking multiple hosts, but it is not how routing or NAT operates; the correct mechanism is port-based multiplexing.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.