Question 655 of 1,389
CCNA Network Services and Security Practice Question
Which TWO statements correctly describe the behavior of PAT (Port Address Translation) as configured on a Cisco router?
⚠ Common exam trap
Cisco often tests the misconception that PAT requires a pool of public IPs or a 1:1 mapping, when in fact PAT is designed for many-to-one translation using port numbers, and can operate with a single public IP address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PAT translates multiple internal addresses to a single public IP address by using unique source port numbers.
PAT (Port Address Translation) translates multiple internal private IP addresses to a single public IP address by assigning unique source port numbers to each session, allowing many internal hosts to share one public IP. This is correctly described in option A. Option D is also correct because PAT uniquely identifies each translation by both the IP address and the port number, enabling the router to demultiplex return traffic. Option B is wrong because PAT uses many-to-one mapping, not 1:1; a 1:1 mapping is characteristic of static NAT. Option C is incorrect because PAT can operate with a single public IP address (often the outside interface address) rather than requiring a pool. Option E is false because PAT translations are dynamically created and time out after a period of inactivity; they are not static.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
PAT translates multiple internal addresses to a single public IP address by using unique source port numbers.
Why this is correct
PAT distinguishes between multiple internal hosts sharing the same public IP by assigning a different source port for each session. The router maintains a translation table that tracks the original internal IP and port along with the assigned public IP and port.
- ✗
PAT requires a 1:1 mapping of internal to external IP addresses.
Why it's wrong here
PAT is the opposite of a 1:1 mapping: it is a many-to-one overload technique that allows every internal host to be represented by the same public IP address. A 1:1 relationship between internal and external addresses describes static NAT or dynamic NAT without overload, where each private address consumes a separate public address. PAT instead differentiates concurrent sessions through unique source port numbers, and it can work with just a single interface IP address, so no pool or 1:1 binding is required.
- ✗
PAT can only be configured with a pool of public IP addresses.
Why it's wrong here
PAT can be configured with either a single public IP address (using the interface address) or a pool of public IP addresses. It does not require a pool; a single address is sufficient for PAT overload.
- ✓
PAT uses both IP addresses and port numbers to track translations.
Why this is correct
PAT tracks translations using a stateful table that pairs the inside local IP and port with the inside global IP and port, along with the outside destination. By including the TCP/UDP port numbers, the router can multiplex thousands of internal clients behind one public IP because each session's IP-and-port tuple is unique. Without the port field, replies could not be correctly reverse-mapped to the originating host, so PAT inherently relies on layer-4 information for its many-to-one operation.
- ✗
PAT translations are always static and never time out.
Why it's wrong here
PAT translations are dynamic by nature: they are created on demand when an internal host starts an outbound session and are removed after the session ends or after an inactivity timeout expires. For example, a TCP entry on Cisco IOS typically times out after 24 hours by default, while UDP entries time out after just a few minutes, and administrators can tune these timers with 'ip nat translation' commands. Static NAT entries persist indefinitely, but PAT entries are intended to be temporary so that ports can be recycled and the limited public address is shared efficiently.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓PAT translates multiple internal addresses to a single public IP address by using unique source port numbers.Correct answer▾
Why this is correct
PAT distinguishes between multiple internal hosts sharing the same public IP by assigning a different source port for each session. The router maintains a translation table that tracks the original internal IP and port along with the assigned public IP and port.
✗PAT requires a 1:1 mapping of internal to external IP addresses.Wrong answer — click to see why▾
Why this is wrong here
PAT does not require a 1:1 mapping; it allows many internal addresses to share a single public IP. A 1:1 mapping is characteristic of static NAT, not PAT.
Why candidates choose this
Students often confuse PAT with static NAT, thinking that each internal host needs its own public IP. They may also misinterpret 'translation' as requiring a one-to-one correspondence.
✗PAT can only be configured with a pool of public IP addresses.Wrong answer — click to see why▾
Why this is wrong here
PAT can be configured with either a single public IP address (using the interface address) or a pool of public IP addresses. It does not require a pool; a single address is sufficient for PAT overload.
Why candidates choose this
Some students believe that PAT, like dynamic NAT, requires a pool of addresses. They may not realize that PAT can overload a single address by using port numbers.
✗PAT translations are always static and never time out.Wrong answer — click to see why▾
Why this is wrong here
PAT translations are dynamic and have a timeout (default 86400 seconds for general translations, but shorter for TCP/UDP). They are removed after the session ends or the timeout expires.
Why candidates choose this
Students may think that all NAT translations are static because they hear about 'static NAT' or confuse PAT with static entries. They might also assume that translations persist indefinitely.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.