CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure dynamic NAT with a pool of public IPs and static NAT for the web server.

  Why it's wrong here

  Dynamic NAT is a many-to-many mapping that requires a pool of public addresses large enough to support the number of concurrent internal hosts. With only one public IP, the pool could contain just one address, so only a single internal host could be translated at a time while all others would fail to get a public mapping. Moreover, dynamic NAT creates transient entries only when traffic is initiated from an inside host, so it cannot provide a fixed inbound path for the web server. Static NAT for the server is acceptable, but the remaining hosts still need PAT to share the lone public IP for outbound connectivity.

• ✓

  Configure PAT (overload) for internal hosts and static NAT for the web server.

  Why this is correct

  This is correct because PAT (overload) allows all internal hosts to share the single public IP for outbound traffic by multiplexing sessions through unique source ports. Simultaneously, a static NAT entry maps the web server's private address to the same public IP (or a dedicated global address) to create a permanent one-to-one relationship. That permanent mapping lets Internet clients initiate inbound connections to the web server, while PAT handles all other internal hosts' outbound requests. Together, they maximize the use of the limited public address space while providing both outbound and inbound connectivity.

• ✗

  Configure only PAT (overload) for all internal hosts including the web server.

  Why it's wrong here

  PAT alone is insufficient because it relies on dynamic translation entries that are created only when an internal host initiates a connection. An inbound packet arriving from the Internet for the web server's public address would find no existing translation, since the web server did not first open a flow, and the router would drop or fail to forward it. The overloaded NAT state is inherently ephemeral and tied to the session's source port, so it cannot offer a stable, externally reachable endpoint for unsolicited traffic. Thus, while PAT is ideal for outbound sharing, it cannot replace the fixed mapping that static NAT provides for inbound services.

• ✗

  Configure static NAT for the web server and use only the public IP for internal hosts.

  Why it's wrong here

  This option fails because assigning the single public IP directly to internal hosts would either duplicate addresses or force each host to have its own unique public IP, which the office does not possess. Static NAT for the web server consumes the public IP as a global address, but if the same public IP is also used for other internal hosts without PAT, the router has no way to distinguish multiple internal hosts sharing one public address. Without overload, the translation table cannot multiplex sessions by port, so only one host could use that IP at a time. The correct approach is to combine static NAT for the server with PAT for all other hosts, allowing the single IP to serve both inbound and outbound traffic simultaneously.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”