Question 289 of 1,389
CCNA Network Services and Security Practice Question
Exhibit
R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- --- --- 192.0.2.12 10.0.0.12 --- --- --- 192.0.2.13 10.0.0.13 --- --- --- 192.0.2.14 10.0.0.14 --- --- --- 192.0.2.15 10.0.0.15 --- --- --- 192.0.2.16 10.0.0.16 --- --- --- 192.0.2.17 10.0.0.17 --- --- --- 192.0.2.18 10.0.0.18 --- --- --- 192.0.2.19 10.0.0.19 --- --- R1# show running-config | include ip nat ip nat pool MYPOOL 192.0.2.10 192.0.2.19 netmask 255.255.255.240 ip nat inside source list 1 pool MYPOOL
A network administrator configured dynamic NAT on a Cisco router to allow internal hosts to access the internet. After the configuration, users report that they can access some websites but not others. The administrator checks the router and discovers that the NAT translation table is full, and new connection attempts are being dropped. What is the most likely cause of this issue?
⚠ Common exam trap
Cisco often tests the distinction between dynamic NAT (one-to-one pool) and PAT (many-to-one), leading candidates to overlook pool exhaustion when symptoms show partial connectivity rather than total failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT pool is exhausted; configure PAT to allow multiple hosts to share a single public IP.
When the NAT pool is exhausted, no new translations can be created, so only hosts that already have established translations can continue to communicate, causing intermittent connectivity. A full NAT table means the pool of public IP addresses is completely allocated, preventing new sessions. Implementing PAT allows multiple inside hosts to share a single public IP by multiplexing port numbers, resolving the pool exhaustion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The inside local addresses are not properly defined in the access list.
Why it's wrong here
The access list defines which inside local addresses are eligible for translation; if it incorrectly excluded the internal hosts, those hosts would never generate NAT entries. Since the NAT table already contains active translations for the inside local addresses, the ACL is correctly matching the intended local networks, allowing them to be translated. Thus, the ACL definition is not the failure point; the translations exist, but new ones cannot be created because the pool of public addresses is spent.
- ✓
The NAT pool is exhausted; configure PAT to allow multiple hosts to share a single public IP.
Why this is correct
The NAT pool contains only 10 inside-global addresses, so a one-to-one dynamic NAT translation consumes an entire public IP for each internal host. Once all 10 addresses are in use, additional translations fail until an entry ages out or is cleared. Configuring PAT (with the overload keyword, e.g., ip nat inside source list 1 pool MY-POOL overload) lets many internal hosts share a single public IP by multiplexing on unique Layer 4 port numbers, eliminating pool exhaustion.
- ✗
The outside interface is not configured with the ip nat outside command.
Why it's wrong here
If the outside interface lacked the ip nat outside command, the router would not apply NAT to traffic leaving that interface, and no translations would exist at all. The presence of active translations proves that the interface connecting to the public network is correctly configured with ip nat outside, because the router is building and maintaining the translation entries. Consequently, the issue is not a missing outside command but the exhaustion of the 10-address NAT pool that the router uses for those translations.
- ✗
The inside interface is not configured with the ip nat inside command.
Why it's wrong here
If the inside interface were missing the ip nat inside command, the router would not consider it the internal NAT interface and would not translate traffic arriving on that interface. The output explicitly shows translations in the NAT table, which proves that at least one interface has been correctly identified as inside and is applying the translation. Therefore, the absent command cannot be the root cause; the problem lies in the finite number of available public addresses.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The NAT pool is exhausted; configure PAT to allow multiple hosts to share a single public IP.Correct answer▾
Why this is correct
The NAT pool contains only 10 inside-global addresses, so a one-to-one dynamic NAT translation consumes an entire public IP for each internal host. Once all 10 addresses are in use, additional translations fail until an entry ages out or is cleared. Configuring PAT (with the overload keyword, e.g., ip nat inside source list 1 pool MY-POOL overload) lets many internal hosts share a single public IP by multiplexing on unique Layer 4 port numbers, eliminating pool exhaustion.
✗The inside local addresses are not properly defined in the access list.Wrong answer — click to see why▾
Why this is wrong here
The access list is used to define which inside local addresses are eligible for NAT. If the access list were misconfigured, the router would not create translations for those hosts. However, the scenario states that translations are present, indicating that the access list is correctly matching the internal hosts.
Why candidates choose this
Students often confuse the role of the access list in NAT with other ACL functions. They might think that an incomplete translation is due to the ACL not permitting certain traffic, but the presence of translations shows the ACL is working.
✗The outside interface is not configured with the ip nat outside command.Wrong answer — click to see why▾
Why this is wrong here
If the outside interface were missing the 'ip nat outside' command, the router would not perform NAT on outbound traffic at all, resulting in no translations being created. Since translations are present, this command is correctly configured.
Why candidates choose this
Students may think that an incomplete translation could be due to a missing 'ip nat outside' command, but that would prevent any translation from being created, not just incomplete ones.
✗The inside interface is not configured with the ip nat inside command.Wrong answer — click to see why▾
Why this is wrong here
Similar to option C, if the inside interface were missing the 'ip nat inside' command, no translations would be created. The presence of translations indicates that the inside interface is correctly configured.
Why candidates choose this
Students might incorrectly attribute incomplete translations to a missing 'ip nat inside' command, but that would cause a complete failure of NAT, not partial functionality.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.