CCNA Network Services and Security Practice Question
Network Topology
You are connected to R1. The network has two routers: R1 (192.168.1.0/24 LAN) and R2 (Internet gateway). R1's inside LAN (192.168.1.0/24) must be translated to the public IP 203.0.113.1 using PAT (NAT overload) for Internet access. Additionally, the server at 192.168.1.100 must be reachable from the Internet via static NAT to 203.0.113.5. The current configuration is broken. Identify and fix the issues so that both PAT and static NAT work correctly.
⚠ Common exam trap
A common trap is confusing inside and outside interface designations. Remember: the interface facing the private network is 'ip nat inside', and the interface facing the public network is 'ip nat outside'. Also, PAT requires the 'overload' keyword; without it, you get dynamic NAT (one-to-one).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and ensure the PAT command includes 'overload'.
The configuration had three issues: 1) ACL 10 permitted 10.0.0.0/8 instead of the actual inside subnet 192.168.1.0/24, so no traffic matched PAT. 2) The PAT command was missing the 'overload' keyword, which is required for Port Address Translation; without it, the device attempts one-to-one dynamic NAT. 3) The interface facing the public network (G0/1) was incorrectly configured as 'ip nat inside' instead of 'ip nat outside'. The fix is to correct the ACL to permit 192.168.1.0 0.0.0.255, ensure the PAT command includes 'overload', and change G0/1 to 'ip nat outside'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and ensure the PAT command includes 'overload'.
Why this is correct
This is correct because the ACL must match the inside LAN (192.168.1.0/24) for PAT to translate traffic. The inside interface for the public IP must be marked as 'ip nat outside' to allow translation of return traffic. The 'overload' keyword enables PAT (port address translation).
- ✗
Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and ensure the PAT command includes 'overload'.
Why it's wrong here
This configuration is still invalid because the interface facing the public IP address must be designated as 'ip nat outside', not 'ip nat inside'. In NAT, translation is only performed between an inside interface and an outside interface; if G0/1 were also marked inside, there would be no outside boundary for the router to translate against, so traffic toward the Internet would not be translated. The ACL change is correct, and 'overload' is needed for PAT, but the interface role is the critical flaw.
- ✗
Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and remove the 'overload' keyword from the PAT command.
Why it's wrong here
Removing the 'overload' keyword would break PAT entirely, because 'overload' is what enables port address translation, allowing multiple inside hosts to share the single public IP simultaneously by multiplexing on unique source ports. Without it, the router would only support a one-to-one translation from a single inside address to the public IP, so only one host could reach the Internet at a time. The ACL and outside interface are correct, but losing 'overload' defeats the requirement of PAT.
- ✗
Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and remove the 'overload' keyword from the PAT command.
Why it's wrong here
This option combines two independent fatal errors: G0/1 is marked 'ip nat inside' even though it connects to the public side, so no outside interface exists to trigger translation, and the 'overload' keyword is removed, which would also eliminate PAT even if the interfaces were correctly configured. Without an outside interface the router cannot build NAT translations for return traffic, and without 'overload' the single public IP cannot be shared among the LAN hosts. Both defects must be fixed simultaneously for PAT to function.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and ensure the PAT command includes 'overload'.Correct answer▾
Why this is correct
This is correct because the ACL must match the inside LAN (192.168.1.0/24) for PAT to translate traffic. The inside interface for the public IP must be marked as 'ip nat outside' to allow translation of return traffic. The 'overload' keyword enables PAT (port address translation).
✗Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and ensure the PAT command includes 'overload'.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the interface with the public IP (203.0.113.1) must be configured as 'ip nat outside', not 'ip nat inside'. Marking it as inside would cause asymmetric NAT behavior and break translation.
Why candidates choose this
Candidates might think both interfaces should be 'inside' because they are both on the router, but the outside interface is the one facing the public network.
✗Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and remove the 'overload' keyword from the PAT command.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that PAT requires the 'overload' keyword. Without it, the router performs dynamic NAT (one-to-one translation), which would not support multiple hosts sharing a single public IP.
Why candidates choose this
Candidates might think 'overload' is optional or that it causes issues with static NAT, but both can coexist; the keyword is necessary for PAT.
✗Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and remove the 'overload' keyword from the PAT command.Wrong answer — click to see why▾
Why this is wrong here
The specific factual errors are: (1) the interface with the public IP must be 'ip nat outside', and (2) PAT requires the 'overload' keyword. Both are violated here.
Why candidates choose this
Candidates might think that removing 'overload' simplifies the configuration and that both interfaces can be 'inside', but this misunderstands NAT interface roles and the need for PAT.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
NAT Types — Static, Dynamic, and PAT
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
Key term
Port Address Translation
A networking technique that maps multiple private IP addresses and their ports to a single public IP address using unique port numbers.
About these practice questions
This 200-301 question is part of Courseiva's 1,450-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-301
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to an ISP router at 10.0.0.2/30. The internal network has a web server at 192.168.1.10 and a mail server at 192.168.1.20. You need to configure NAT so that internal hosts can access the internet (PAT overload) and external users can reach the web server via public IP 203.0.113.10 and the mail server via public IP 203.0.113.11. The inside interface is GigabitEthernet0/1 (192.168.1.1/24) and the outside interface is GigabitEthernet0/0.
hard- ✓ A.ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255 interface GigabitEthernet0/1 ip nat inside interface GigabitEthernet0/0 ip nat outside ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80 extendable ip nat inside source static tcp 192.168.1.20 25 203.0.113.11 25 extendable
- B.ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255 interface GigabitEthernet0/1 ip nat outside interface GigabitEthernet0/0 ip nat inside ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80 ip nat inside source static tcp 192.168.1.20 25 203.0.113.11 25
- C.ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255 interface GigabitEthernet0/1 ip nat inside interface GigabitEthernet0/0 ip nat outside ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload ip nat inside source static 192.168.1.10 203.0.113.10 ip nat inside source static 192.168.1.20 203.0.113.11
- D.ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255 interface GigabitEthernet0/1 ip nat inside interface GigabitEthernet0/0 ip nat outside ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload ip nat outside source static tcp 203.0.113.10 80 192.168.1.10 80 ip nat outside source static tcp 203.0.113.11 25 192.168.1.20 25
Why A: Option A correctly configures NAT overload for internal hosts and static PAT for the web and mail servers using the 'extendable' keyword. The 'ip nat inside source static tcp' command with 'extendable' allows multiple static translations that can coexist with the overload translation, which is necessary when the same outside interface is used for both PAT and static NAT. The inside and outside interfaces are correctly marked.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.