CCNA Network Services and Security Practice Question
Network Topology
You are connected to R1. The inside network 192.168.1.0/24 must be able to access the internet using PAT (NAT overload) with the outside interface G0/1 IP 203.0.113.1. Additionally, the internal server at 192.168.1.10 must be reachable from the internet via static NAT to 203.0.113.10. The current configuration is incomplete and contains errors. Identify and fix all issues so that both PAT and static NAT work correctly.
⚠ Common exam trap
This question tests your ability to identify multiple simultaneous NAT configuration errors. Common traps include forgetting the 'overload' keyword, misconfiguring ACLs, and swapping inside/outside interfaces. Always verify interface NAT directions first, as they are foundational.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Swap ip nat inside/outside on interfaces, add 'overload' to the dynamic NAT rule, and correct ACL 1 to permit 192.168.1.0/24.
The configuration had multiple faults: 1) Inside/outside interfaces were swapped – G0/0 (LAN) should be inside, G0/1 (WAN) should be outside. 2) The PAT command was missing the 'overload' keyword. 3) ACL 1 permitted the wrong subnet (192.168.2.0/24 instead of 192.168.1.0/24). 4) The static NAT configuration was correct, but the interface misconfiguration prevented it from working. Fixes: swap ip nat inside/outside on the interfaces, add 'overload' to the dynamic NAT rule, and correct ACL 1 to permit 192.168.1.0/24.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Swap ip nat inside/outside on interfaces, add 'overload' to the dynamic NAT rule, and correct ACL 1 to permit 192.168.1.0/24.
Why this is correct
Ly identifies all three faults: the inside/outside interface assignments were reversed, the PAT command lacked the 'overload' keyword, and ACL 1 permitted the wrong subnet. Fixing these ensures both PAT and static NAT function properly.
- ✗
Change the static NAT inside address to 192.168.1.1 and add 'overload' to the dynamic NAT rule.
Why it's wrong here
This is incorrect because the static NAT inside address (192.168.1.10) is correct as per the requirement. Changing it to 192.168.1.1 would break the requirement. Additionally, only one fault (missing 'overload') is addressed, ignoring the interface and ACL issues.
- ✗
Remove the static NAT configuration and rely solely on PAT for the server.
Why it's wrong here
Removing the static NAT rule would eliminate the inbound translation that maps the public address to the internal server, directly violating the stated requirement that the server must be reachable from the internet via static NAT. PAT alone (even with 'overload') only enables multiple internal hosts to share one public IP for outbound sessions; it does not provide the fixed one-to-one mapping needed for unsolicited inbound traffic to reach the server. Furthermore, the 'overload' keyword is missing from the current dynamic rule, so simply relying on PAT without fixing that fault would still leave outbound translation broken. This option thereby ignores the core static NAT requirement, the missing 'overload', and the reversed interface assignments.
- ✗
Add the 'overload' keyword to the dynamic NAT rule and correct ACL 1 to permit 192.168.1.0/24.
Why it's wrong here
This option correctly identifies the missing 'overload' keyword and the ACL permitting the wrong subnet, but it fails to address the reversed 'ip nat inside' and 'ip nat outside' assignments on the interfaces. In NAT/PAT, the inside and outside designations are relative to the translation domain: traffic entering an 'inside' interface is subject to inside-to-outside translation, and traffic entering an 'outside' interface is subject to outside-to-inside translation. With the assignments swapped, the router would attempt to translate traffic in the wrong direction, causing both the dynamic PAT rule and the static NAT rule to malfunction regardless of the ACL and 'overload' corrections. Without first correcting the interface directions, the ACL fix and 'overload' addition alone cannot restore connectivity for internal hosts or inbound access to the server.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Swap ip nat inside/outside on interfaces, add 'overload' to the dynamic NAT rule, and correct ACL 1 to permit 192.168.1.0/24.Correct answer▾
Why this is correct
Ly identifies all three faults: the inside/outside interface assignments were reversed, the PAT command lacked the 'overload' keyword, and ACL 1 permitted the wrong subnet. Fixing these ensures both PAT and static NAT function properly.
✗Change the static NAT inside address to 192.168.1.1 and add 'overload' to the dynamic NAT rule.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the static NAT inside address is already correct; altering it is unnecessary and incorrect.
Why candidates choose this
Candidates might think the server's inside address should be the default gateway (192.168.1.1) or confuse it with the inside global address.
✗Remove the static NAT configuration and rely solely on PAT for the server.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that static NAT is required for inbound access; PAT alone cannot provide a fixed public-to-private mapping.
Why candidates choose this
Candidates might think PAT can handle all traffic, but PAT only translates multiple private addresses to a single public address and does not allow unsolicited inbound connections without additional configuration.
✗Add the 'overload' keyword to the dynamic NAT rule and correct ACL 1 to permit 192.168.1.0/24.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that interface NAT direction is fundamental; if inside/outside are reversed, NAT translations will not be applied correctly.
Why candidates choose this
Candidates might focus on the ACL and PAT keyword but overlook the interface configuration, which is a common misconfiguration in NAT setups.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
WAN
A Wide Area Network (WAN) is a telecommunications network that connects multiple smaller networks, like local area networks, across large geographical distances.
Key term
Port Address Translation
A networking technique that maps multiple private IP addresses and their ports to a single public IP address using unique port numbers.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.