CCNA Network Services and Security Practice Question
A network technician has configured static NAT with the command ip nat inside source static 192.168.1.10 203.0.113.10. The web server at 192.168.1.10 is accessible from the internet on TCP port 80 but not on TCP port 443. The ACL applied to the outside interface permits all IP traffic. What is the most appropriate next step to troubleshoot this issue?
⚠ Common exam trap
Cisco often tests the misconception that a static NAT or ACL must be explicitly configured for each port, when in fact static NAT translates all ports, and the ACL in this scenario already permits all traffic, so the issue must be at the application layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check if the web server is running HTTPS service on port 443.
The symptom (port 80 works, port 443 fails) with a static NAT that maps the entire IP address (not just specific ports) indicates the issue is likely at the server itself, not the NAT configuration. Static NAT translates all traffic for the inside local IP to the inside global IP, so if one TCP port works and another does not, the NAT is functioning correctly. The most appropriate next step is to verify that the web server is actually listening on TCP port 443 (HTTPS), as the server may not have the HTTPS service running or configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check if the web server is running HTTPS service on port 443.
Why this is correct
Because the existing ACL permits all IP traffic and the static NAT rule already translates port 80 successfully, the network and translation layers are validated for HTTP. Since HTTPS uses a different application-layer service and TCP port 443, the most likely failure point is the web server not listening for HTTPS connections. Checking whether the server is running HTTPS on port 443 isolates the issue to the application layer, which is the correct next step.
- ✗
Verify that the ACL applied to the outside interface explicitly permits TCP port 443.
Why it's wrong here
The ACL applied to the outside interface is configured to permit all IP traffic, which inherently includes TCP port 443. Therefore, there is no need to verify an explicit permit statement for HTTPS, as the current ACL already allows any destination port. This action would attempt to fix a Layer 4 filtering problem that cannot exist given the blanket permit rule.
- ✗
Examine the NAT translation table for any conflicting dynamic entries.
Why it's wrong here
Static NAT creates a fixed, one-to-one mapping that takes precedence over any dynamic translation entries in the NAT table. Since the configuration uses only static NAT for the server, dynamic entries cannot conflict with or override the static mapping. Examining the translation table for dynamic conflicts is irrelevant because the working port 80 translation already proves the static entry is functional and unaffected by other entries.
- ✗
Confirm the inside global IP address mapped to the server is correct.
Why it's wrong here
The correct inside global IP address mapping is already proven by the fact that port 80 HTTP traffic reaches the server successfully. If the mapped IP address were incorrect, all traffic to the server would fail, not just HTTPS. Thus, re-confirming the inside global address is redundant and would not address the specific HTTPS service failure on port 443.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Check if the web server is running HTTPS service on port 443.Correct answer▾
Why this is correct
Because the existing ACL permits all IP traffic and the static NAT rule already translates port 80 successfully, the network and translation layers are validated for HTTP. Since HTTPS uses a different application-layer service and TCP port 443, the most likely failure point is the web server not listening for HTTPS connections. Checking whether the server is running HTTPS on port 443 isolates the issue to the application layer, which is the correct next step.
✗Verify that the ACL applied to the outside interface explicitly permits TCP port 443.Wrong answer — click to see why▾
Why this is wrong here
The already-configured ACL permits all IP traffic, so explicitly allowing port 443 would not resolve a server not listening on that port. This step wastes time on a verified configuration.
✗Examine the NAT translation table for any conflicting dynamic entries.Wrong answer — click to see why▾
Why this is wrong here
Static NAT does not use dynamic overload entries. There are no conflicting entries because NAT overload is not configured, making this check irrelevant.
✗Confirm the inside global IP address mapped to the server is correct.Wrong answer — click to see why▾
Why this is wrong here
The fact that port 80 works shows the inside global IP is correct. Re-verifying it would not explain the port-specific failure, as the issue is not with the translation.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.