CCNA Network Services and Security Practice Question
Exhibit
R1# show ip nat translations verbose Pro Inside global Inside local Outside local Outside global --- 203.0.113.5 10.1.1.0/24 --- --- udp 203.0.113.5:1024 10.1.1.10:5000 198.51.100.10:53 198.51.100.10:53 create 00:03:45, use 00:00:10 timeout: 300000, flags: extended dynamic, mapping-id: 2 udp 203.0.113.5:1024 10.1.1.11:5001 198.51.100.10:53 198.51.100.10:53 create 00:03:45, use 00:00:10 timeout: 300000, flags: extended dynamic, mapping-id: 2 tcp 203.0.113.5:1024 10.1.1.12:34567 203.0.113.100:443 203.0.113.100:443 create 00:01:22, use 00:00:05 timeout: 86400, flags: extended dynamic, mapping-id: 2 tcp 203.0.113.5:1024 10.1.1.13:45678 203.0.113.200:22 203.0.113.200:22 create 00:00:55, use 00:00:03 timeout: 86400, flags: extended dynamic, mapping-id: 2
Refer to the exhibit. A network administrator configures NAT overload on R1 to allow internal hosts in the 10.1.1.0/24 subnet to access the Internet. After the configuration, the administrator runs the show ip nat translations verbose command and notices that several internal sessions all appear to use the same inside global port 1024. The administrator is concerned that port conflicts will occur. Based on the output, which statement is correct?
⚠ Common exam trap
Cisco often tests the misconception that sharing the same inside global port automatically causes a conflict, when in fact PAT uses the full 5-tuple to maintain uniqueness across sessions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The translations are extended entries, so the combination of inside global IP, outside global IP, and port ensures each session is unique, even though the inside global port is the same.
NAT overload (PAT) creates extended entries that uniquely identify each session by the combination of inside global IP, outside global IP, and port. Even though multiple sessions share the same inside global port 1024, the different outside global IP addresses and ports ensure that each translation entry is unique, preventing port conflicts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NAT configuration is missing the overload keyword, causing all internal hosts to share a single source port.
Why it's wrong here
Missing the overload keyword would result in dynamic NAT that maps one inside local address to one inside global address at a time, not PAT that reuses ports. In that case, the translations would not have the 'extended' flag and would show only one inside local address per global address. The exhibit shows multiple inside local addresses all mapped to the same global IP with a port, which is classic PAT, indicating overload is configured.
- ✗
The static NAT entry mapping 203.0.113.5 to the entire 10.1.1.0/24 subnet forces all subordinate translations to use the same port 1024.
Why it's wrong here
The line '--- 203.0.113.5 10.1.1.0/24 --- ---' is not a static NAT configuration; it is a summary line that indicates the inside global IP assigned to the 10.1.1.0/24 subnet for dynamic translations. It does not force a specific port. The dynamic entries below show the actual PAT translations.
- ✗
The dynamic NAT pool is exhausted, forcing the router to reuse port 1024 for all new sessions.
Why it's wrong here
If the pool were exhausted, the router would either refuse new translations or reuse a global address, but PAT would still assign different source ports. The exhibit shows four concurrent translations all using the same global port, which indicates that the router is differentiating sessions by destination, not that the pool is exhausted.
- ✓
The translations are extended entries, so the combination of inside global IP, outside global IP, and port ensures each session is unique, even though the inside global port is the same.
Why this is correct
Each table entry carries the 'extended' flag, which means the translation includes the destination address and port. This allows the same inside global port 1024 to be used simultaneously for different destinations (198.51.100.10:53, 203.0.113.100:443, 203.0.113.200:22). The five‑tuple still uniquely identifies the session, so port conflicts do not occur.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The translations are extended entries, so the combination of inside global IP, outside global IP, and port ensures each session is unique, even though the inside global port is the same.Correct answer▾
Why this is correct
Each table entry carries the 'extended' flag, which means the translation includes the destination address and port. This allows the same inside global port 1024 to be used simultaneously for different destinations (198.51.100.10:53, 203.0.113.100:443, 203.0.113.200:22). The five‑tuple still uniquely identifies the session, so port conflicts do not occur.
✗The NAT configuration is missing the overload keyword, causing all internal hosts to share a single source port.Wrong answer — click to see why▾
Why this is wrong here
Candidates think that seeing the same global port means overload is not operating, but port reuse is normal in extended PAT.
✗The static NAT entry mapping 203.0.113.5 to the entire 10.1.1.0/24 subnet forces all subordinate translations to use the same port 1024.Wrong answer — click to see why▾
Why this is wrong here
Candidates may misinterpret the summary line as a static identity NAT rule that locks all translations to a single port.
✗The dynamic NAT pool is exhausted, forcing the router to reuse port 1024 for all new sessions.Wrong answer — click to see why▾
Why this is wrong here
Candidates confuse pool exhaustion (no free global addresses) with port reuse. Exhaustion typically manifests as translation failures, not as many entries sharing the same port.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Port Address Translation
A networking technique that maps multiple private IP addresses and their ports to a single public IP address using unique port numbers.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.