Question 1,819 of 1,389
CCNA Network Services and Security Practice Question
Exhibit
R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 203.0.113.10 192.168.1.10 198.51.100.1 198.51.100.1 --- 203.0.113.11 192.168.1.20 198.51.100.2 198.51.100.2 R1# show ip nat statistics Total active translations: 2 (0 static, 2 dynamic; 2 extended) Pool translations: 2 Outside interfaces: GigabitEthernet0/0 Inside interfaces: GigabitEthernet0/1 Hits: 5 Misses: 0 CEF Translated packets: 5, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat pool POOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0 access-list NAT permit 192.168.1.0 0.0.0.255 Refcount: 2
A network engineer notices that internal hosts (192.168.1.0/24) can reach external servers on the internet, but replies from external servers never reach the internal hosts. The router R1 is configured with dynamic NAT to translate the internal subnet to a pool of public IPs (203.0.113.10-203.0.113.20). The engineer runs 'show ip nat translations' and sees only a few stale translations. What is the most likely cause of the issue?
⚠ Common exam trap
Cisco often tests the requirement that both 'ip nat inside' and 'ip nat outside' must be configured on the respective interfaces for NAT to work bidirectionally, and the trap here is that candidates assume only the inside interface needs the command or confuse the symptom with pool exhaustion or ACL issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The outside interface (GigabitEthernet0/0) is missing the 'ip nat outside' command.
The 'ip nat outside' command must be applied to the interface facing the external network (GigabitEthernet0/0) for the router to translate return traffic. Without it, the router does not perform NAT on packets arriving on that interface, so replies from external servers are forwarded without translation back to the inside local IPs, which are not routable on the internet. The stale translations indicate that outbound translations were created but never used for return traffic, confirming the missing outside interface command.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The access list 'NAT' is incorrect; it should permit only specific hosts, not the entire subnet.
Why it's wrong here
The access list 'NAT' is not the problem. In dynamic NAT, the ACL is used solely to identify which inside addresses are eligible for translation, and permitting the entire internal subnet is standard and correct when all internal hosts should have Internet access. Even if the ACL were narrowed to specific hosts, the router would still fail to translate return packets because the outside interface has not been designated with 'ip nat outside'. The ACL only controls which source addresses are translated, not whether NAT is applied on an interface.
- ✓
The outside interface (GigabitEthernet0/0) is missing the 'ip nat outside' command.
Why this is correct
The outside interface GigabitEthernet0/0 is missing the 'ip nat outside' command, which breaks NAT in both directions. For NAT to function, each interface must be explicitly marked as either 'ip nat inside' or 'ip nat outside'. With only 'ip nat inside' on the internal interface and no 'ip nat outside' on the external interface, the router will translate the source IP of outgoing packets but will not know to translate the destination IP of incoming return packets. Therefore, the return traffic cannot be matched to the existing translation entry, and the response packets are dropped or sent without translation, causing the no-reply symptom.
- ✗
The NAT configuration lacks the 'overload' keyword, so the pool is exhausted quickly.
Why it's wrong here
The lack of the 'overload' keyword is a red herring here. Without overload, the router performs standard dynamic NAT, which still works correctly as long as the number of active inside addresses does not exceed the number of addresses in the pool. In the scenario, there are only 2 active translations and 11 addresses in the pool, so the pool is not exhausted and overload would not change the immediate outcome. The real issue is that the outside interface is not configured for NAT, and adding overload cannot compensate for that missing interface-level command.
- ✗
The NAT pool 'POOL' has too few addresses; it should be expanded to a /24 subnet.
Why it's wrong here
The NAT pool 'POOL' has 11 addresses, which is more than enough for the two active translations, so pool size is not causing the problem. Expanding the pool to a /24 subnet would only increase the maximum number of concurrent translations; it would not make the router process return traffic on the outside interface. Even with 254 public addresses available, the router would still not translate reply packets because the outside interface is not marked with 'ip nat outside'. The symptom of no replies is a direct result of missing interface NAT designation, not address exhaustion.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The outside interface (GigabitEthernet0/0) is missing the 'ip nat outside' command.Correct answer▾
Why this is correct
The outside interface GigabitEthernet0/0 is missing the 'ip nat outside' command, which breaks NAT in both directions. For NAT to function, each interface must be explicitly marked as either 'ip nat inside' or 'ip nat outside'. With only 'ip nat inside' on the internal interface and no 'ip nat outside' on the external interface, the router will translate the source IP of outgoing packets but will not know to translate the destination IP of incoming return packets. Therefore, the return traffic cannot be matched to the existing translation entry, and the response packets are dropped or sent without translation, causing the no-reply symptom.
✗The access list 'NAT' is incorrect; it should permit only specific hosts, not the entire subnet.Wrong answer — click to see why▾
Why this is wrong here
The access list correctly matches the internal subnet, so this is not the root cause.
✗The NAT configuration lacks the 'overload' keyword, so the pool is exhausted quickly.Wrong answer — click to see why▾
Why this is wrong here
Even without overload, dynamic NAT should work for the first 11 hosts; the problem is that return packets are not being translated.
✗The NAT pool 'POOL' has too few addresses; it should be expanded to a /24 subnet.Wrong answer — click to see why▾
Why this is wrong here
The pool size is not the issue; the router is not translating return traffic due to missing 'ip nat outside'.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.