CCNA Network Services and Security Practice Question
Network Topology
You are connected to R1. The inside network 192.168.1.0/24 must be translated to the outside interface IP (198.51.100.1) using PAT (NAT overload). Additionally, a static NAT entry must map host 192.168.1.10 to 203.0.113.10. The current configuration is incomplete and contains errors. Correct the configuration so that both translations work properly.
⚠ Common exam trap
Watch out for three common mistakes: 1) Forgetting to set the outside interface as 'ip nat outside'. 2) Using an ACL that does not match the inside network. 3) Omitting the 'overload' keyword for PAT. Also, do not add protocol/port to static NAT unless specifically required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
interface GigabitEthernet0/1 ip nat outside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 overload ip nat inside source static 192.168.1.10 203.0.113.10
The configuration has three issues: 1) GigabitEthernet0/1 is incorrectly set as 'ip nat inside' instead of 'ip nat outside'. 2) The PAT command is missing the 'overload' keyword. 3) Access-list 1 permits 10.0.0.0/8, not the inside subnet 192.168.1.0/24. The commands fix these: change the interface to 'ip nat outside', add 'overload' to the PAT command, and update the ACL to permit the correct inside network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
interface GigabitEthernet0/1 ip nat outside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 overload ip nat inside source static 192.168.1.10 203.0.113.10
Why this is correct
This configuration is fully correct because it designates the WAN interface as the outside, which is mandatory for NAT/PAT to translate packets crossing from the internal LAN to the public network. The access-list matches the exact inside local subnet 192.168.1.0/24, and the overload keyword enables port address translation, allowing all internal hosts to share the single public IP of the GigabitEthernet0/1 interface. Additionally, the static NAT entry creates a persistent one-to-one mapping for 192.168.1.10 to 203.0.113.10, ensuring inbound and outbound traffic for that host is translated consistently.
- ✗
interface GigabitEthernet0/1 ip nat inside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 overload ip nat inside source static 192.168.1.10 203.0.113.10
Why it's wrong here
This configuration is wrong because it marks GigabitEthernet0/1 as an inside interface, so no interface is designated as ip nat outside; therefore, the router cannot determine which direction traffic must take for translation to occur. The PAT rule uses the same interface as the inside source, but without an outside interface, the command has no effect and will not translate traffic leaving the LAN. Although the ACL and static entry are correct, the missing outside designation invalidates the entire NAT configuration, because NAT requires at least one inside and one outside interface to function.
- ✗
interface GigabitEthernet0/1 ip nat outside ! access-list 1 permit 10.0.0.0 0.255.255.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 ip nat inside source static 192.168.1.10 203.0.113.10
Why it's wrong here
This configuration fails because the ACL matches 10.0.0.0/8, which does not cover the actual inside network 192.168.1.0/24, so the PAT rule will never translate traffic from the LAN. Even if the ACL were corrected, the absence of the overload keyword would restrict translations to one inside host per outside destination at a time, causing PAT to run out of ports and breaking communication for multiple simultaneous sessions. The static NAT entry is valid, but the dynamic translation is useless without the proper ACL and overload setting, making the overall configuration incorrect.
- ✗
interface GigabitEthernet0/1 ip nat outside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 overload ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80
Why it's wrong here
This is incorrect because the static NAT entry specifies a TCP port, which would only translate traffic for that specific port and protocol, not all traffic for host 192.168.1.10. The requirement is for a full static NAT mapping.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓interface GigabitEthernet0/1 ip nat outside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 overload ip nat inside source static 192.168.1.10 203.0.113.10Correct answer▾
Why this is correct
This configuration is fully correct because it designates the WAN interface as the outside, which is mandatory for NAT/PAT to translate packets crossing from the internal LAN to the public network. The access-list matches the exact inside local subnet 192.168.1.0/24, and the overload keyword enables port address translation, allowing all internal hosts to share the single public IP of the GigabitEthernet0/1 interface. Additionally, the static NAT entry creates a persistent one-to-one mapping for 192.168.1.10 to 203.0.113.10, ensuring inbound and outbound traffic for that host is translated consistently.
✗interface GigabitEthernet0/1 ip nat inside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 overload ip nat inside source static 192.168.1.10 203.0.113.10Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the interface facing the outside (public) network is incorrectly configured as 'ip nat inside'.
Why candidates choose this
Candidates might think that both inside and outside interfaces can be marked as 'inside' if they are internal, but the outside interface must be explicitly marked as 'outside'.
✗interface GigabitEthernet0/1 ip nat outside ! access-list 1 permit 10.0.0.0 0.255.255.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 ip nat inside source static 192.168.1.10 203.0.113.10Wrong answer — click to see why▾
Why this is wrong here
The specific factual errors are: 1) The ACL does not match the correct inside network. 2) The 'overload' keyword is omitted, preventing PAT from working.
Why candidates choose this
Candidates might mistakenly use a standard ACL that permits a different private range (10.0.0.0/8) and forget the 'overload' keyword, thinking it is optional.
✗interface GigabitEthernet0/1 ip nat outside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 overload ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the static NAT command includes protocol and port, limiting the translation to TCP port 80 only.
Why candidates choose this
Candidates might think that static NAT requires specifying a port for the translation, but a simple 'ip nat inside source static' without port creates a one-to-one mapping for all traffic.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.