CCNA Network Services and Security Practice Question
Exhibit
R1# show running-config | section ip nat ip nat inside source list 100 interface GigabitEthernet0/1 ip nat inside source static tcp 192.168.1.100 80 interface GigabitEthernet0/1 80 ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.248 ip nat inside ! access-list 100 permit ip 192.168.2.0 0.0.0.255 any
You are connected to R1. The internal network 192.168.1.0/24 must be able to access the Internet via PAT (NAT overload) using the outside interface G0/1 with IP 203.0.113.1. Additionally, a web server at 192.168.1.100 must be reachable from the Internet via static NAT to the same outside interface. The current configuration has errors. Correct the NAT configuration so that inside hosts can browse the web and the server is reachable from outside.
⚠ Common exam trap
Watch for three common mistakes in NAT configuration: (1) misplacing the 'inside' and 'outside' interface designations, (2) forgetting the 'overload' keyword for PAT, and (3) using an incorrect ACL that does not match the actual inside network. Always verify the ACL matches the source subnet of traffic needing translation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change interface G0/1 to 'ip nat outside', add 'overload' to the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255
The configuration had three issues: (1) Interface G0/1 was incorrectly configured as 'ip nat inside' instead of 'ip nat outside' — this prevents translation as both interfaces are inside. (2) The NAT overload keyword was missing on the dynamic PAT rule — without 'overload', only one-to-one translation occurs. (3) ACL 100 was matching 192.168.2.0/24 instead of the actual inside subnet 192.168.1.0/24, so traffic from the correct subnet was not translated. Correcting these allows inside hosts to PAT to the outside IP and the static NAT to function properly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Change interface G0/1 to 'ip nat outside', add 'overload' to the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255
Why this is correct
This is the correct set of fixes. For PAT to function, the router must know which interface is inside and which is outside; G0/1 faces the public ISP, so it needs 'ip nat outside.' The 'overload' keyword is mandatory when the outside global pool has only one address, because it enables the router to track unique source port numbers and map many inside local addresses to that single public IP. Finally, ACL 100 is the 'inside local' match criterion, so it must match the actual internal subnet 192.168.1.0/24; otherwise the source IPs on real internal traffic will not be translated.
- ✗
Change interface G0/1 to 'ip nat outside', add 'overload' to the dynamic NAT rule, and change ACL 100 to permit 192.168.2.0 0.0.0.255
Why it's wrong here
This combination would still be broken because ACL 100 points to the wrong subnet. In Cisco IOS, 'ip nat inside source list 100' uses ACL 100 to identify which inside-local addresses are eligible for translation; permitting 192.168.2.0 0.0.0.255 means only that nonexistent subnet would be translated, while real traffic sourced from 192.168.1.0/24 would not match the ACL and would exit without NAT. The outside interface and overload settings are correct, but the ACL match criterion must reflect the actual inside network, so this answer fails to fix the problem.
- ✗
Change interface G0/1 to 'ip nat outside', remove the 'overload' keyword from the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255
Why it's wrong here
Removing 'overload' is the critical error here. Without 'overload,' the dynamic NAT rule translates IP addresses one-to-one, using each pool address for a single inside host at a time; if the pool contains only one public IP, only one internal host can communicate at a time and all other hosts fail. Even though G0/1 is correctly set to outside and ACL 100 now matches the right subnet, PAT is disabled and the configuration does not meet the requirement for many internal hosts sharing the single outside address. The answer must keep 'overload' to enable port address translation.
- ✗
Change interface G0/1 to 'ip nat inside', add 'overload' to the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255
Why it's wrong here
Setting G0/1 to 'ip nat inside' is the fatal mistake. An interface must be designated either inside or outside with respect to NAT; G0/1 is the interface connecting to the external network, so it must be 'ip nat outside.' If both G0/1 and the LAN interface are marked inside, Cisco IOS has no outside interface to use as the translation egress, and packets leaving G0/1 will never have their source addresses translated. The ACL and overload changes are correct, but the direction/designation is reversed.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Change interface G0/1 to 'ip nat outside', add 'overload' to the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255Correct answer▾
Why this is correct
This is the correct set of fixes. For PAT to function, the router must know which interface is inside and which is outside; G0/1 faces the public ISP, so it needs 'ip nat outside.' The 'overload' keyword is mandatory when the outside global pool has only one address, because it enables the router to track unique source port numbers and map many inside local addresses to that single public IP. Finally, ACL 100 is the 'inside local' match criterion, so it must match the actual internal subnet 192.168.1.0/24; otherwise the source IPs on real internal traffic will not be translated.
✗Change interface G0/1 to 'ip nat outside', add 'overload' to the dynamic NAT rule, and change ACL 100 to permit 192.168.2.0 0.0.0.255Wrong answer — click to see why▾
Why this is wrong here
The ACL must match the source subnet of the inside hosts that need translation; using 192.168.2.0/24 does not match 192.168.1.0/24.
Why candidates choose this
Candidates might misread the subnet or think the ACL is correct if they confuse the two subnets.
✗Change interface G0/1 to 'ip nat outside', remove the 'overload' keyword from the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255Wrong answer — click to see why▾
Why this is wrong here
The 'overload' keyword is essential for PAT; omitting it means only one inside host can use the outside IP at a time.
Why candidates choose this
Candidates might think 'overload' is optional or confuse it with static NAT, not realizing PAT requires it.
✗Change interface G0/1 to 'ip nat inside', add 'overload' to the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255Wrong answer — click to see why▾
Why this is wrong here
NAT requires one interface to be 'inside' and the other 'outside'; having both as 'inside' prevents translation of outbound traffic.
Why candidates choose this
Candidates might think the outside interface should be 'inside' because it connects to the internal network, or they may confuse the direction of NAT.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.