CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.

  Why this is correct

  This is the correct fix because it addresses all three requirements. The ACL is the match criteria for the ip nat inside source list command, so it must permit 192.168.1.0/24, the actual inside local network, rather than 192.168.2.0/24. Adding overload enables Port Address Translation, which lets multiple inside hosts share the single public IP by multiplexing on source port. Finally, show ip nat translations confirms that inside local-to-global mapping entries are being generated for real traffic.

• ✗

  Change ACL 100 to permit 192.168.1.0 0.0.0.255 and add the 'overload' keyword to the ip nat inside source list command.

  Why it's wrong here

  The ACL and overload changes are correctly identified, but the answer is incomplete because it stops at configuration and never proves the fix. In a CCNA troubleshooting scenario, show ip nat translations is the mandatory validation step to see whether the router is actually translating addresses from the permitted inside network. Without that output, a candidate cannot confirm that the ACL is being hit, overload is working, or that translation entries are not timing out, so the configuration might still be failing.

• ✗

  Add the 'overload' keyword to the ip nat inside source list command and verify with 'show ip nat translations'.

  Why it's wrong here

  This option adds the overload keyword and verification, but it leaves the ACL unchanged, so the NAT rule will still only match traffic from 192.168.2.0/24. Since the inside network is 192.168.1.0/24, packets sourced from that subnet will not match the access list and will be forwarded without translation, even if overload is enabled. Changing the ACL is the foundational fix; without it, no NAT translation or PAT entry can be created for the actual inside hosts.

• ✗

  Change ACL 100 to permit 192.168.1.0 0.0.0.255 and verify with 'show ip nat translations'.

  Why it's wrong here

  This option corrects the ACL and includes verification, but it fails to add overload to the ip nat inside source list command. Without overload, the router performs dynamic one-to-one NAT, meaning only a single inside host can use the translated public address and subsequent inside hosts will fail to get a translation when the pool is exhausted. The overload keyword is what enables PAT, allowing many internal hosts to share one public IP by tracking sessions with unique source ports, so its omission leaves the configuration unable to support multiple users.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question