CCNA Network Services and Security Practice Question
An internal server must always be reachable from outside using the same public IP address. Which translation approach is most appropriate?
⚠ Common exam trap
A common exam trap is selecting PAT overload instead of static NAT for a server that must be reachable from outside using the same public IP. PAT overload is designed for many internal hosts sharing a single public IP for outbound connections, not for providing a fixed public IP for inbound access. This misunderstanding leads to incorrect assumptions about how inbound traffic is handled. The exam tests your ability to distinguish between dynamic port-based translation and static one-to-one mappings, so confusing these concepts can cause you to choose the wrong NAT approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static NAT
A static NAT mapping is the most appropriate approach. In plain language, the outside world needs a stable public address that always represents the same internal server. Static NAT provides that fixed one-to-one relationship, which makes the service reachable predictably. PAT is better suited for many outbound users sharing one public address, not for presenting one inside server with a consistent external identity. The correct answer is the one that provides a permanent mapping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Static NAT
Why this is correct
Static NAT creates a one-to-one fixed mapping between an inside private IP and an inside global public IP. This ensures the server's public address never changes, so inbound connections from the Internet to that address are always translated to the same internal server. It also allows the server to initiate outbound traffic with a consistent source address. This is required for an internal server to be reachable from outside.
- ✗
PAT overload
Why it's wrong here
PAT (Port Address Translation) overload maps many internal addresses to a single public IP by multiplexing on transport-layer ports. It is designed for outbound-initiated sessions; it does not create a fixed inbound mapping. While a static PAT rule could be configured for a specific port to the server, plain PAT overload without such a static entry would not reliably allow inbound connections from outside to the server. It also consumes the public IP for many internal hosts, and the server's external address is not predetermined. So it's wrong for ensuring always reachable.
When this WOULD be correct
If the question stated that multiple internal servers need to be accessible from the outside using a single public IP address, and the focus was on conserving IP addresses while allowing multiple connections, PAT overload would be the correct answer. This would apply in scenarios where port numbers can differentiate between connections.
- ✗
No NAT
Why it's wrong here
Without NAT, the internal server would use a private IPv4 address (RFC 1918) which is not routable on the public Internet. Routers on the Internet would drop packets destined to that private address because they have no route. Thus, no outside host could reach the server. So no NAT fails the requirement.
When this WOULD be correct
In a scenario where the question asks for a method to connect internal devices directly to the internet without any IP address translation, 'No NAT' would be the correct answer. This could involve a setup where all devices are assigned public IPs directly, eliminating the need for NAT.
- ✗
DHCP relay
Why it's wrong here
DHCP relay is a feature used to forward DHCP broadcast messages between clients and a DHCP server located on a different subnet. It assigns IP addresses dynamically and has nothing to do with address translation or inbound reachability. It doesn't provide any public address or route for the server. Thus it is unrelated to making a server reachable from outside.
When this WOULD be correct
If the question asked about ensuring that DHCP clients can receive IP addresses from a remote DHCP server while maintaining connectivity across different subnets, DHCP relay would be the correct answer. This scenario would focus on the management of IP address assignment rather than NAT.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Static NATCorrect answer▾
Why this is correct
Static NAT creates a one-to-one fixed mapping between an inside private IP and an inside global public IP. This ensures the server's public address never changes, so inbound connections from the Internet to that address are always translated to the same internal server. It also allows the server to initiate outbound traffic with a consistent source address. This is required for an internal server to be reachable from outside.
✗PAT overloadWrong answer — click to see why▾
Why this is wrong here
PAT (Port Address Translation) overload uses a single public IP address for multiple internal hosts by differentiating sessions via port numbers. It does not provide a fixed public-to-private mapping, so an external host cannot consistently reach a specific internal server using the same public IP and port without additional configuration like port forwarding, which is not the same as static NAT.
★ When this WOULD be the correct answer
If the question stated that multiple internal servers need to be accessible from the outside using a single public IP address, and the focus was on conserving IP addresses while allowing multiple connections, PAT overload would be the correct answer. This would apply in scenarios where port numbers can differentiate between connections.
Why candidates choose this
Students might confuse PAT with static NAT because both involve translating private addresses to public ones. However, PAT is primarily designed for many-to-one outbound translations, not for providing a fixed inbound mapping for a server.
✗No NATWrong answer — click to see why▾
Why this is wrong here
No NAT means the server would use its private IP address directly, but private IPv4 addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are not routable on the public internet. Therefore, the server would not be reachable from outside without address translation.
★ When this WOULD be the correct answer
In a scenario where the question asks for a method to connect internal devices directly to the internet without any IP address translation, 'No NAT' would be the correct answer. This could involve a setup where all devices are assigned public IPs directly, eliminating the need for NAT.
Why candidates choose this
Some students might think that if a server is directly connected to the internet with a public IP, no NAT is needed. However, the question specifies an internal server, implying it uses a private IP, so translation is required.
✗DHCP relayWrong answer — click to see why▾
Why this is wrong here
DHCP relay is used to forward DHCP broadcast messages between clients and servers across different subnets. It has no role in providing external reachability or IP address translation for a server.
★ When this WOULD be the correct answer
If the question asked about ensuring that DHCP clients can receive IP addresses from a remote DHCP server while maintaining connectivity across different subnets, DHCP relay would be the correct answer. This scenario would focus on the management of IP address assignment rather than NAT.
Why candidates choose this
The term 'relay' might be confused with 'translation' or 'forwarding' in the context of network address translation. However, DHCP relay is a completely different function related to IP address assignment, not persistent external access.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
Port Address Translation
A networking technique that maps multiple private IP addresses and their ports to a single public IP address using unique port numbers.
Key term
Public IP address
A globally unique IP address assigned to a device that allows it to communicate directly over the internet.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.