CCNA Network Services and Security Practice Question
Exhibit
R1# show running-config | section ip nat ip nat inside source list 10 interface GigabitEthernet0/1 overload ip nat inside source static tcp 192.168.1.10 80 203.0.113.3 80 extendable ! access-list 10 permit 10.0.0.0 0.255.255.255 ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.2 255.255.255.248 ip nat outside !
You are connected to R1. The network uses 192.168.1.0/24 for internal hosts and 203.0.113.0/29 for the public IP pool (203.0.113.2 is the outside interface). Configure PAT so that inside hosts can reach the Internet using the pool address 203.0.113.2. Also configure static NAT to map internal server 192.168.1.10 to 203.0.113.3. The initial config has errors; identify and fix them.
⚠ Common exam trap
Candidates often overlook the ACL used in NAT and assume the NAT configuration is complete. Always verify that the ACL matches the inside network exactly. Also, remember that static NAT and PAT can coexist; do not remove static NAT if it is required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change ACL 10 to permit 192.168.1.0 0.0.0.255 and ensure the NAT pool and PAT are correctly configured.
The ACL 10 permits 10.0.0.0/8, but inside hosts are on 192.168.1.0/24 — this ACL does not match the inside subnet, so PAT fails. The static NAT is correct. To fix: change ACL 10 to permit 192.168.1.0 0.0.0.255. Also ensure the PAT references the correct ACL; currently it uses list 10, so after fixing the ACL, PAT will work. No other changes needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Change ACL 10 to permit 192.168.1.0 0.0.0.255 and ensure the NAT pool and PAT are correctly configured.
Why this is correct
This is correct because the original ACL 10 permits 10.0.0.0/8, which does not match the inside subnet 192.168.1.0/24. By changing the ACL to permit the correct subnet, PAT will work for inside hosts. The static NAT for the server is already correct.
- ✗
Change the NAT pool to use a different public IP address and update the static NAT mapping.
Why it's wrong here
Switching the NAT pool to a different public IP or adjusting the static NAT mapping would not resolve the fact that ACL 10 rejects 192.168.1.0/24 as a translation candidate, so PAT would still not be applied to inside hosts. The existing pool and static mapping are correctly sized and assigned; changing them could actually create an overlap or break the fixed inbound mapping for the server, while the sole misconfiguration is the ACL's source network statement.
- ✗
Remove the static NAT and use PAT for the server as well.
Why it's wrong here
Removing the static NAT and placing the server behind PAT would eliminate the permanent one-to-one mapping that is explicitly required for inbound access to the server, because PAT relies on dynamic port assignments and cannot guarantee a fixed public destination address. The server's static NAT entry is independent of the PAT issue affecting other hosts; the real problem is the ACL that defines which inside sources are eligible for translation, so the server configuration must remain intact while ACL 10 is corrected.
- ✗
Change the inside interface IP address to match the ACL.
Why it's wrong here
Altering the inside interface IP to match ACL 10 would require renumbering the entire 192.168.1.0/24 subnet, including hosts, default gateways, and DHCP scopes, and would also change the inside address space that the static NAT entry for the server references. The actual fault is that ACL 10 permits 10.0.0.0/8, but the inside LAN uses 192.168.1.0/24; the ACL is the source-matching mechanism for PAT and must be corrected to reflect the real internal subnet, not the interface address.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Change ACL 10 to permit 192.168.1.0 0.0.0.255 and ensure the NAT pool and PAT are correctly configured.Correct answer▾
Why this is correct
This is correct because the original ACL 10 permits 10.0.0.0/8, which does not match the inside subnet 192.168.1.0/24. By changing the ACL to permit the correct subnet, PAT will work for inside hosts. The static NAT for the server is already correct.
✗Change the NAT pool to use a different public IP address and update the static NAT mapping.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the pool address 203.0.113.2 and static mapping to 203.0.113.3 are valid and do not need changing.
Why candidates choose this
Candidates might think the pool or static mapping is wrong because they misread the requirements or assume a conflict, but the problem is solely the ACL.
✗Remove the static NAT and use PAT for the server as well.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that PAT does not allow inbound connections initiated from outside; static NAT is required for that purpose.
Why candidates choose this
Candidates might think PAT can handle all traffic, but static NAT is necessary for servers that need to be reachable from the Internet.
✗Change the inside interface IP address to match the ACL.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the inside interface IP is part of the 192.168.1.0/24 network and should not be changed; the ACL should be adjusted instead.
Why candidates choose this
Candidates might think the ACL is correct and the network should be changed to match, but that is not practical and would break connectivity.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.