CCNA Network Services and Security Practice Question
A router is configured with PAT for inside users. Which symptom most strongly suggests the NAT inside/outside roles are reversed on the interfaces?
⚠ Common exam trap
A common exam trap is assuming that NAT translation problems are caused by ACL or overload command errors, while overlooking the inside/outside interface roles. Candidates may see private IP addresses in outbound traffic and mistakenly focus on ACL syntax or NAT pool definitions. However, the root cause is often reversed interface roles, which prevent the router from applying PAT correctly. This trap leads to wasted time troubleshooting unrelated configurations and missing the fundamental NAT directionality requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Outbound traffic still shows private inside source addresses where translated public addresses should appear.
When NAT inside/outside roles are reversed, the router applies translation logic in the wrong direction, causing traffic from the inside network to leave the outside interface with untranslated private source addresses. The correct answer (A) directly demonstrates this failure: outbound traffic still shows private IPs where a public address should appear after PAT. The other options describe symptoms that could occur with other NAT misconfigurations but do not strongly indicate reversed roles: an empty translation table (B) suggests no NAT processing at all, possibly due to missing ACL or overload configuration; total lack of internet access (C) may result from many connectivity issues, not specifically reversed interface roles; and external hosts reaching internal servers by private IP (D) points more to a missing or incorrect static NAT rule rather than direction reversal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Outbound traffic still shows private inside source addresses where translated public addresses should appear.
Why this is correct
Outbound traffic showing private inside source addresses where translated public addresses should appear is the most direct symptom of reversed inside/outside roles. When roles are reversed, the router applies translation in the wrong direction, so inside hosts' traffic leaving the outside interface remains untranslated.
- ✗
The NAT translation table is empty even though internal users are browsing the internet.
Why it's wrong here
An empty NAT translation table while internal users are browsing the internet indicates that NAT is not being triggered at all, which could be due to a missing ip nat inside/outside command on the interface, an incorrect ACL, or no overload/ip nat inside source list configuration. It does not specifically point to reversed roles, as reversed roles would still show some translations (but for the wrong direction).
When this WOULD be correct
In a question focused on STP behavior in a switched network, a scenario might ask about network topology changes affecting bridge priorities. If the question specifies that a switch detects a topology change, then this option could be correct as it relates to STP operations.
- ✗
Internal hosts cannot reach the internet at all.
Why it's wrong here
Internal hosts being unable to reach the internet can result from many issues (e.g., routing problems, ACLs blocking traffic, misconfigured default gateway) and is not a specific indicator of reversed NAT interface roles. Reversed NAT might still allow connectivity but with untranslated addresses.
When this WOULD be correct
In a question asking about the effects of a misconfigured DHCP server or a network device that automatically updates its hostname based on a dynamic DNS service, this option could be correct. For example, if the router is set to update its hostname based on the IP address assigned by DHCP, it would change if the DHCP lease changes.
- ✗
External hosts can connect to internal servers using their private IP addresses.
Why it's wrong here
External hosts connecting to internal servers using private IP addresses suggests that either there is a static NAT misconfiguration or that the inside/outside roles are reversed, but it is not as strong an indicator as option A. With reversed roles, external hosts might see private addresses as source but not necessarily be able to connect using those addresses as destinations.
When this WOULD be correct
In a question focused on DHCP server functionality, if a scenario describes a network where DHCP clients are unable to obtain IP addresses across multiple VLANs, option D would be correct as it directly addresses DHCP lease requests.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Outbound traffic still shows private inside source addresses where translated public addresses should appear.Correct answer▾
Why this is correct
Outbound traffic showing private inside source addresses where translated public addresses should appear is the most direct symptom of reversed inside/outside roles. When roles are reversed, the router applies translation in the wrong direction, so inside hosts' traffic leaving the outside interface remains untranslated.
✗The NAT translation table is empty even though internal users are browsing the internet.Wrong answer — click to see why▾
Why this is wrong here
An empty translation table while users browse indicates that PAT is not being applied at all, likely due to a missing ACL or overload statement, not merely reversed roles.
★ When this WOULD be the correct answer
In a question focused on STP behavior in a switched network, a scenario might ask about network topology changes affecting bridge priorities. If the question specifies that a switch detects a topology change, then this option could be correct as it relates to STP operations.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of network protocols, mistakenly linking STP behavior with NAT configurations, or confusing symptoms of network issues across different layers of the OSI model.
✗Internal hosts cannot reach the internet at all.Wrong answer — click to see why▾
Why this is wrong here
Total loss of internet access can stem from many causes (e.g., routing, interface status, ACL denials) and does not specifically highlight NAT inside/outside reversal.
★ When this WOULD be the correct answer
In a question asking about the effects of a misconfigured DHCP server or a network device that automatically updates its hostname based on a dynamic DNS service, this option could be correct. For example, if the router is set to update its hostname based on the IP address assigned by DHCP, it would change if the DHCP lease changes.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of how NAT and device configurations interact, leading them to incorrectly associate hostname changes with network misconfigurations.
✗External hosts can connect to internal servers using their private IP addresses.Wrong answer — click to see why▾
Why this is wrong here
This symptom usually occurs when static NAT is misconfigured or missing, not when the inside/outside roles are reversed on a PAT setup.
★ When this WOULD be the correct answer
In a question focused on DHCP server functionality, if a scenario describes a network where DHCP clients are unable to obtain IP addresses across multiple VLANs, option D would be correct as it directly addresses DHCP lease requests.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of how NAT and DHCP interact, mistakenly believing that DHCP issues could indicate NAT misconfiguration, leading to confusion between the two concepts.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.