CCNA Network Services and Security Practice Question
Which THREE statements correctly describe the configuration and verification of NAT, PAT, and static NAT?
⚠ Common exam trap
Cisco often tests the distinction between 'show ip nat statistics' (counters and summary) and 'show ip nat translations' (active mappings), leading candidates to mistakenly believe that statistics shows the actual translation entries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To configure static NAT, use the command 'ip nat inside source static <inside-local> <inside-global>'.
The 'ip nat inside source static' command creates a one-to-one permanent NAT mapping. Option B is correct because PAT is configured by adding the 'overload' keyword to a dynamic NAT statement that references an ACL and an interface, allowing many private addresses to share a single public IP with different port numbers. Option D is correct: dynamic NAT requires a NAT pool defined with 'ip nat pool' and an access list to identify the inside traffic to be translated. Option C is incorrect because 'show ip nat statistics' only displays counters and summary information, not the active translation entries; those are shown with 'show ip nat translations'. Option E is incorrect because 'show ip interface brief' does not show NAT translation mappings; verification of static NAT requires 'show ip nat translations'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To configure static NAT, use the command 'ip nat inside source static <inside-local> <inside-global>'.
Why this is correct
Static NAT establishes a permanent, one-to-one mapping between a private inside local address and a public inside global address using the 'ip nat inside source static' command. This is ideal for servers that need to be consistently reachable from the outside, as the translation does not change. Additionally, you must designate which interfaces are inside and outside using 'ip nat inside' and 'ip nat outside' for the mapping to be applied correctly.
- ✓
PAT uses the command 'ip nat inside source list <acl> interface <interface> overload' to translate multiple inside addresses to the interface's IP using different port numbers.
Why this is correct
PAT, also known as NAT overload, uses the command 'ip nat inside source list <acl> interface <interface> overload', where the ACL identifies inside local addresses to be translated. The 'overload' keyword enables port address translation, allowing the single IP address of the specified interface to be shared by multiple inside hosts, with each session differentiated by its source port number. This is the most common form of NAT used for internet access because it conserves public IPv4 addresses.
- ✗
The command 'show ip nat statistics' displays the current active translations including inside and outside addresses.
Why it's wrong here
The 'show ip nat statistics' command provides aggregate counters such as total translations, hits, misses, and pool usage, but it does not display the actual NAT translation entries. To see the individual inside local, inside global, outside local, and outside global address mappings, you must use 'show ip nat translations'. Therefore, this command is incorrect for viewing active translations.
- ✓
When configuring dynamic NAT, you must define a NAT pool using the command 'ip nat pool <name> <start-ip> <end-ip> netmask <mask>' and then use an ACL to match inside traffic.
Why this is correct
Configuring dynamic NAT involves creating a pool of public addresses with 'ip nat pool <name> <start-ip> <end-ip> netmask <mask>', which defines the inside global address space. The ACL is then used to match the inside local addresses that are eligible for translation, and the two are bound together using 'ip nat inside source list <acl> pool <name>'. This setup requires that the pool contains enough addresses to accommodate the maximum number of simultaneous translations, otherwise packets will be dropped once the pool is exhausted.
- ✗
To verify that static NAT is working, you should check the output of 'show ip interface brief' and look for the translated IP.
Why it's wrong here
The 'show ip interface brief' command only displays interface status, protocol, and IP address information, not NAT translation details. It would not reveal any static NAT mappings or translated addresses. To verify a static NAT configuration, you need to use 'show ip nat translations' to see the actual mapping, or 'show ip nat statistics' to confirm that the translation counter is incrementing.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓To configure static NAT, use the command 'ip nat inside source static <inside-local> <inside-global>'.Correct answer▾
Why this is correct
Static NAT establishes a permanent, one-to-one mapping between a private inside local address and a public inside global address using the 'ip nat inside source static' command. This is ideal for servers that need to be consistently reachable from the outside, as the translation does not change. Additionally, you must designate which interfaces are inside and outside using 'ip nat inside' and 'ip nat outside' for the mapping to be applied correctly.
✗The command 'show ip nat statistics' displays the current active translations including inside and outside addresses.Wrong answer — click to see why▾
Why this is wrong here
The command 'show ip nat statistics' provides summary statistics such as total translations, hits, misses, and expired translations, but it does not list the actual translation entries. To view active translations, you must use 'show ip nat translations'.
Why candidates choose this
Students often confuse 'show ip nat statistics' with 'show ip nat translations' because both commands are used for NAT verification. The word 'statistics' might imply detailed information, but it only gives aggregate data, not the specific mappings.
✗To verify that static NAT is working, you should check the output of 'show ip interface brief' and look for the translated IP.Wrong answer — click to see why▾
Why this is wrong here
The command 'show ip interface brief' displays the status and IP addresses of interfaces, but it does not show NAT translations. To verify static NAT, you should use 'show ip nat translations' or 'show ip nat statistics' to confirm the mapping is active.
Why candidates choose this
Since 'show ip interface brief' is a common verification command for interface IPs, students might mistakenly think it also shows translated IPs. The similarity in the word 'interface' and the fact that static NAT maps IPs can lead to this confusion.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Dynamic NAT
Dynamic NAT is a method of mapping multiple private IP addresses to a pool of public IP addresses automatically, allowing many devices to share a limited number of public addresses.
Key term
Static NAT
Static Network Address Translation (NAT) is a one-to-one mapping between a private IP address and a public IP address that never changes.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.