Question 1,359 of 1,389
CCNA Network Services and Security Practice Question
Exhibit
R1# show ip nat statistics Total active translations: 0 (0 static, 0 dynamic; 0 extended) Peak translations: 0, occurred 00:00:00 ago Outside interfaces: GigabitEthernet0/0 Inside interfaces: GigabitEthernet0/1 Hits: 0 Misses: 15042 CEF Translated packets: 0, CEF Punted packets: 15042 Expired translations: 0 Dynamic mappings: -- Inside Source [Id: 1] access-list 1 interface GigabitEthernet0/1 refcount 0 pool: (none) refcount: 0
Refer to the exhibit. An administrator has configured PAT for internal hosts to access the internet, but users report that they cannot reach external websites. The administrator suspects a NAT issue and runs the show ip nat statistics command. What is the most likely cause of the problem?
⚠ Common exam trap
Cisco often tests the distinction between inside and outside interface configuration in NAT, where candidates may overlook that the overload pool must reference the outside interface (Gi0/0) rather than the inside interface (Gi0/1) for internet-bound traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT overload pool is incorrectly configured with the inside interface Gi0/1 instead of the outside interface Gi0/0.
The show ip nat statistics output likely shows that the NAT overload pool is referencing the inside interface (Gi0/1) instead of the outside interface (Gi0/0). For PAT (overload) to work, the router must translate the source IP of internal traffic to the IP address of the outside interface (Gi0/0) that connects to the internet. If the pool incorrectly uses the inside interface IP, the translated packets will have a source address that is not routable on the external network, causing connectivity failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The NAT overload pool is incorrectly configured with the inside interface Gi0/1 instead of the outside interface Gi0/0.
Why this is correct
The ip nat inside source list 1 interface GigabitEthernet0/1 overload statement binds the overload pool to Gi0/1, which is an inside interface per the interface commands. Since NAT overload must use the outside interface's address as the public source address, this misconfiguration prevents any valid translation from being built. The dynamic mapping line clearly shows the wrong interface, making this the definitive root cause of the misses.
- ✗
The access-list 1 used in the NAT statement is not matching any traffic.
Why it's wrong here
Although a misconfigured access-list could prevent traffic from being matched, the exhibit's dynamic mapping explicitly displays the incorrect interface binding, so the ACL is not the issue. If the ACL were failing, the NAT statistics would likely show zero matches rather than translation misses, and the mapping line would not reference the inside interface. A quick 'show access-lists 1' would confirm whether matches exist, but the interface error is the primary fault.
- ✗
CEF switching is disabled, causing all packets to be punted to the process level and NAT to fail.
Why it's wrong here
CEF is not disabled in this scenario; the presence of CEF-punted packets equal to the misses indicates that NAT is actively punting packets to the CPU because it cannot resolve a translation, not that CEF is off. Disabling CEF would result in process switching for all traffic, but the router still operates with CEF enabled and simply fails to create a NAT entry. The punt counter is a symptom of the interface misconfiguration, not an independent cause.
- ✗
The maximum number of NAT translations has been reached, causing new translations to be denied.
Why it's wrong here
The output shows 0 active translations, so the NAT table is far from exhausted; a maximum-limit issue would typically display an exceeded counter or deny new translations. The misses are occurring because the NAT statement references an inside interface, causing the router to attempt an invalid translation, not because of table resource exhaustion. Even if a limit were reached, the active translation count would be at the maximum, which contradicts the exhibit's data.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The NAT overload pool is incorrectly configured with the inside interface Gi0/1 instead of the outside interface Gi0/0.Correct answer▾
Why this is correct
The ip nat inside source list 1 interface GigabitEthernet0/1 overload statement binds the overload pool to Gi0/1, which is an inside interface per the interface commands. Since NAT overload must use the outside interface's address as the public source address, this misconfiguration prevents any valid translation from being built. The dynamic mapping line clearly shows the wrong interface, making this the definitive root cause of the misses.
✗The access-list 1 used in the NAT statement is not matching any traffic.Wrong answer — click to see why▾
Why this is wrong here
Candidates may focus on Hits: 0 and Misses: 15042 as typical of an ACL issue, but the explicit interface binding in the dynamic mapping is the direct evidence of misconfiguration.
✗CEF switching is disabled, causing all packets to be punted to the process level and NAT to fail.Wrong answer — click to see why▾
Why this is wrong here
The high CEF Punted count mirrors the misses, leading some to believe CEF is the problem, but the exhibit does not indicate CEF is disabled.
✗The maximum number of NAT translations has been reached, causing new translations to be denied.Wrong answer — click to see why▾
Why this is wrong here
Candidates might assume that a high miss count reflects a full translation table, but the total active translations show 0.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.