CCNA Network Services and Security Practice Question
Network Topology
You are connected to R1. Configure static NAT for a public web server (198.51.100.10 to 192.168.1.10) and PAT for the 192.168.1.0/24 LAN to use interface GigabitEthernet0/1 with overload. The current configuration has misconfigured NAT that prevents both types from working. Identify and fix the issues so that internal hosts can access the internet and external hosts can reach the internal web server.
⚠ Common exam trap
Watch out for three common traps: (1) Misidentifying inside vs. outside interfaces—the interface facing the public network is always outside. (2) Forgetting the 'overload' keyword for PAT—without it, you get dynamic NAT, not PAT. (3) Using the wrong ACL—the ACL must match the inside network exactly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.
Three issues exist: (1) GigabitEthernet0/1 is the outside interface but is configured as 'ip nat inside' — it should be 'ip nat outside'. (2) The PAT command lacks the 'overload' keyword, so it does one-to-one translation instead of port address translation. (3) ACL 1 permits 192.168.2.0/24, but the inside LAN is 192.168.1.0/24 — the ACL must match the correct subnet. Correcting these allows PAT for the LAN and static NAT for the web server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.
Why this is correct
This configuration is fully correct because it addresses all three faults in the original setup. First, GigabitEthernet0/1 connects to the public network, so it must be marked 'ip nat outside' to tell the router which interface carries the translated source addresses. Second, the 'overload' keyword is mandatory for PAT; without it, the command creates dynamic one-to-one NAT, which fails when multiple internal hosts share a single public IP. Third, ACL 1 must match the actual inside LAN, 192.168.1.0/24, using the wildcard 0.0.0.255, so that traffic sourced from that subnet is eligible for translation.
- ✗
Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and change ACL 1 to permit 192.168.2.0 0.0.0.255.
Why it's wrong here
This answer correctly changes the outside interface and adds 'overload', but it fails because ACL 1 still references the wrong subnet. The wildcard 0.0.0.255 only matches addresses in the 192.168.2.0/24 range, while the inside LAN is 192.168.1.0/24. As a result, traffic from the real internal network would not match the ACL and would not be translated, breaking outbound connectivity. The ACL must identify the source network of the hosts that need PAT, not an unrelated subnet.
- ✗
Change interface GigabitEthernet0/1 to 'ip nat inside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.
Why it's wrong here
Although the PAT overload command and the corrected ACL are present, this option misidentifies the outside interface. GigabitEthernet0/1 is the interface facing the public network, so it requires 'ip nat outside' to enable translation of source addresses as packets exit that interface. Setting it to 'ip nat inside' would tell the router that the public-facing side is an internal network, and the router would not translate outgoing packets correctly. Both the inside and outside designations must align with the actual network topology for NAT to function.
- ✗
Change interface GigabitEthernet0/1 to 'ip nat outside', remove the 'overload' keyword from the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.
Why it's wrong here
This option correctly sets the outside interface and fixes the ACL, but it removes 'overload' from the NAT command, which defeats the purpose of PAT. Without 'overload', the command 'ip nat pool ...' performs dynamic NAT, mapping each inside local address to a unique inside global address from the pool. In this scenario, there is only one public IPv4 address available, so one-to-one translation would exhaust the pool after the first host and drop translations for all subsequent hosts. The 'overload' keyword is essential to allow many internal hosts to share the single public address via unique source ports.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.Correct answer▾
Why this is correct
This configuration is fully correct because it addresses all three faults in the original setup. First, GigabitEthernet0/1 connects to the public network, so it must be marked 'ip nat outside' to tell the router which interface carries the translated source addresses. Second, the 'overload' keyword is mandatory for PAT; without it, the command creates dynamic one-to-one NAT, which fails when multiple internal hosts share a single public IP. Third, ACL 1 must match the actual inside LAN, 192.168.1.0/24, using the wildcard 0.0.0.255, so that traffic sourced from that subnet is eligible for translation.
✗Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and change ACL 1 to permit 192.168.2.0 0.0.0.255.Wrong answer — click to see why▾
Why this is wrong here
The ACL must match the inside network; permitting a different subnet will not translate traffic from the correct LAN.
Why candidates choose this
Candidates may misread the LAN subnet or think the ACL is correct as given.
✗Change interface GigabitEthernet0/1 to 'ip nat inside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.Wrong answer — click to see why▾
Why this is wrong here
The NAT inside/outside designation is based on the direction of traffic; the interface facing the public network must be outside.
Why candidates choose this
Candidates often confuse inside and outside interfaces, especially when both static NAT and PAT are used.
✗Change interface GigabitEthernet0/1 to 'ip nat outside', remove the 'overload' keyword from the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.Wrong answer — click to see why▾
Why this is wrong here
Without 'overload', the router will not use port numbers to multiplex multiple inside hosts to a single public IP.
Why candidates choose this
Candidates may think 'overload' is optional or misunderstand its purpose in conserving IP addresses.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.