CCNA Network Services and Security Practice Question
Exhibit
R1#show running-config | section access-list|ip nat|interface GigabitEthernet0/1|interface GigabitEthernet0/2|interface GigabitEthernet0/0 access-list 10 permit 192.168.10.0 0.0.0.255 access-list 20 permit 192.168.20.0 0.0.0.0 ip nat pool NAT-POOL 200.1.1.1 200.1.1.2 netmask 255.255.255.252 ip nat inside source list 10 pool NAT-POOL overload ip nat inside source list 20 pool NAT-POOL overload interface GigabitEthernet0/0 ip address 200.1.1.1 255.255.255.252 ip nat outside interface GigabitEthernet0/1 ip address 192.168.10.1 255.255.255.0 ip nat inside interface GigabitEthernet0/2 ip address 192.168.20.1 255.255.255.0 ip nat inside
A network administrator is troubleshooting an issue where hosts in the 192.168.20.0/24 subnet cannot reach the Internet, while hosts in 192.168.10.0/24 can. The router is configured for PAT overload using a dynamic pool on the outside interface. The administrator collects the configuration shown in the exhibit. What is the most likely cause of the connectivity problem for the 192.168.20.0/24 subnet?
⚠ Common exam trap
Cisco often tests the distinction between matching the network address versus matching the host range in ACLs used for NAT, where candidates incorrectly assume that using the network address with a wildcard mask of 0.0.0.0 will match all hosts in the subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The wildcard mask in access list 20 is incorrect; it matches only the network address.
The issue is that access list 20, used to define which internal addresses are eligible for NAT, has a wildcard mask of 0.0.0.0. This wildcard mask matches only the exact address 192.168.20.0, not the entire 192.168.20.0/24 subnet. For a /24 subnet, the correct wildcard mask should be 0.0.0.255, which would match all addresses from 192.168.20.1 to 192.168.20.254. Because the ACL matches only the network address (192.168.20.0), no host traffic from that subnet is translated, breaking Internet connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The wildcard mask in access list 20 is incorrect; it matches only the network address.
Why this is correct
Access list 20 uses wildcard mask 0.0.0.0, which requires an exact match on all 32 bits; therefore it matches only the host address 192.168.20.0, not the entire subnet. For NAT to translate all hosts in the 192.168.20.0/24 network, the wildcard mask must be 0.0.0.255, causing the router to ignore the last octet and match addresses from .1 to .254. As written, only traffic sourced from 192.168.20.0 (which is practically never used as a source IP) would be translated, so all other hosts in that subnet fail to access the outside network.
- ✗
The NAT pool does not have enough IP addresses to support both subnets.
Why it's wrong here
The 'overload' keyword enables Port Address Translation (PAT), which allows many inside local addresses to share a single public IP by multiplexing sessions on unique source port numbers. With PAT, even a single address in the pool can support thousands of simultaneous connections, so a pool of two addresses is more than sufficient for both subnets. The failure is not due to address exhaustion, but because ACL 20 fails to match the intended hosts, so they never even reach the translation decision.
- ✗
Interface GigabitEthernet0/2 is missing the ip nat inside command.
Why it's wrong here
The exhibited configuration correctly applies the 'ip nat inside' command to GigabitEthernet0/2, which is the interface facing the internal networks. This command designates that interface as the inside boundary for NAT, so any traffic received there is evaluated against the access lists for translation. Missing this command would prevent NAT from processing those packets, but since it is already present, the problem must lie elsewhere—specifically in the overly restrictive ACL 20.
- ✗
Access list 10 is incorrectly applied to the NAT pool, causing a conflict.
Why it's wrong here
It is perfectly valid to reference the same NAT pool from multiple access lists; each ACL independently determines which source addresses from its corresponding subnet are eligible for translation. Access list 10 uses the correct wildcard mask 0.0.0.255 to match the entire 192.168.10.0/24 subnet, so those hosts translate successfully without any conflict. The router evaluates the lists separately based on source IP, and having both maps to the same pool with 'overload' does not cause an error or interference.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The wildcard mask in access list 20 is incorrect; it matches only the network address.Correct answer▾
Why this is correct
Access list 20 uses wildcard mask 0.0.0.0, which requires an exact match on all 32 bits; therefore it matches only the host address 192.168.20.0, not the entire subnet. For NAT to translate all hosts in the 192.168.20.0/24 network, the wildcard mask must be 0.0.0.255, causing the router to ignore the last octet and match addresses from .1 to .254. As written, only traffic sourced from 192.168.20.0 (which is practically never used as a source IP) would be translated, so all other hosts in that subnet fail to access the outside network.
✗The NAT pool does not have enough IP addresses to support both subnets.Wrong answer — click to see why▾
Why this is wrong here
NAT pool size is not a limiting factor with PAT overload; a single address can serve thousands of hosts.
✗Interface GigabitEthernet0/2 is missing the ip nat inside command.Wrong answer — click to see why▾
Why this is wrong here
The interface is correctly configured for NAT inside.
✗Access list 10 is incorrectly applied to the NAT pool, causing a conflict.Wrong answer — click to see why▾
Why this is wrong here
Applying multiple access lists to the same pool is allowed and does not create a conflict.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.