CCNA Network Services and Security Practice Question
Network Topology
You are connected to R1. The network uses private IP 10.10.10.0/24 on the inside and must reach the Internet via the outside interface G0/1 with public IP 203.0.113.1/29. Configure PAT (NAT overload) so that inside hosts can access the Internet, and also configure a static NAT for the internal server 10.10.10.100 to public IP 203.0.113.2. The current configuration has errors: the inside and outside interfaces are swapped, the ACL is incorrectly defined, and the overload keyword is missing. Fix all issues.
⚠ Common exam trap
Watch out for three common NAT configuration mistakes: swapping inside/outside interface designations, using an ACL that does not match the actual inside network, and forgetting the 'overload' keyword for PAT. Always verify the interface IP addresses and the ACL permit statement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overload
The configuration had three faults: (1) The inside interface (G0/0 with private IP) was marked 'ip nat outside', and the outside interface (G0/1 with public IP) was marked 'ip nat inside' — these must be swapped. (2) The ACL 10 permitted 192.168.1.0/24 instead of the actual inside subnet 10.10.10.0/24. (3) The NAT command 'ip nat inside source list 10 interface GigabitEthernet0/1' was missing the 'overload' keyword, which is required for PAT. The static NAT was correctly defined. After fixing all three, inside hosts will be able to access the Internet using PAT.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overload
Why this is correct
This configuration correctly sets the inside interface (G0/0 with private IP) to 'ip nat inside' and the outside interface (G0/1 with public IP) to 'ip nat outside'. The ACL permits the correct inside subnet 10.10.10.0/24, and the NAT command includes the 'overload' keyword for PAT, enabling multiple inside hosts to share the public IP.
- ✗
On G0/0: ip nat outside; on G0/1: ip nat inside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overload
Why it's wrong here
This is incorrect because the inside and outside interface designations are swapped. The interface with the private IP (G0/0) should be 'ip nat inside', and the interface with the public IP (G0/1) should be 'ip nat outside'. Swapping them would cause NAT to fail as the router would not correctly identify which traffic is internal.
- ✗
On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 192.168.1.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overload
Why it's wrong here
This is incorrect because the ACL permits the wrong subnet (192.168.1.0/24) instead of the actual inside subnet (10.10.10.0/24). The ACL must match the source IP addresses of the internal hosts that need to be translated. Using the wrong subnet would prevent translation for the actual inside hosts.
- ✗
On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1
Why it's wrong here
This is incorrect because the NAT command is missing the 'overload' keyword. Without 'overload', the router will perform dynamic NAT (one-to-one translation) instead of PAT (many-to-one). Since there is only one public IP address (203.0.113.1) on the outside interface, dynamic NAT would fail for multiple hosts, as it requires a pool of public IPs.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overloadCorrect answer▾
Why this is correct
This configuration correctly sets the inside interface (G0/0 with private IP) to 'ip nat inside' and the outside interface (G0/1 with public IP) to 'ip nat outside'. The ACL permits the correct inside subnet 10.10.10.0/24, and the NAT command includes the 'overload' keyword for PAT, enabling multiple inside hosts to share the public IP.
✗On G0/0: ip nat outside; on G0/1: ip nat inside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overloadWrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the 'ip nat inside' and 'ip nat outside' commands are applied to the wrong interfaces. The inside interface must be the one facing the internal network, and the outside interface must be the one facing the external network.
Why candidates choose this
Candidates might confuse which interface is inside and outside, especially if they think of 'inside' as the network being translated and 'outside' as the public network, but they may misapply the commands based on interface names rather than IP addresses.
✗On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 192.168.1.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overloadWrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the ACL does not match the correct inside network. The ACL in the NAT configuration must permit the exact private IP range used on the inside network.
Why candidates choose this
Candidates might mistakenly use a common private IP range like 192.168.1.0/24 out of habit, or they might misread the question and think the inside network is 192.168.1.0/24 instead of 10.10.10.0/24.
✗On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is the omission of the 'overload' keyword. PAT (overload) is required to allow multiple inside hosts to share a single public IP address by using different source ports.
Why candidates choose this
Candidates might forget the 'overload' keyword because they think dynamic NAT is sufficient, or they may not realize that without 'overload', the router expects a pool of addresses and will not translate multiple hosts to a single interface IP.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
Port Address Translation
A networking technique that maps multiple private IP addresses and their ports to a single public IP address using unique port numbers.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.