CCNA Network Services and Security Practice Question
Exhibit
show run | section nat ip nat inside source list 10 interface g0/0 overload access-list 10 permit 192.168.10.0 0.0.0.255
Exhibit: An administrator wants inside hosts in 192.168.10.0/24 to reach the internet using one public IP address on the edge router. Which feature is being used?
⚠ Common exam trap
Be careful not to confuse the different types of NAT. Remember, PAT is specifically for sharing one public IP among many devices using port numbers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PAT overload
When many inside private addresses share one public address and are differentiated by Layer 4 port numbers, the router is using PAT. Cisco documentation often calls this NAT overload.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Static NAT
Why it's wrong here
Static NAT creates a one-to-one mapping between a private inside address and a public outside address. For the 192.168.10.0/24 network, this would require a unique public IP for each host, which is neither scalable nor practical when only a single interface address is available. The overload keyword, used for PAT, is specifically absent in static NAT configurations.
When this WOULD be correct
In a scenario where the question states that a specific internal host needs to be consistently reachable from the internet using a fixed public IP, Static NAT would be the correct answer. For example, if the question specified that a web server with IP 192.168.10.10 should always be accessible via the public IP 203.0.113.5, Static NAT would apply.
- ✗
Policy-based routing
Why it's wrong here
Policy-based routing (PBR) intercepts packets and forces them to follow a configured next hop or interface based on match criteria like source IP or protocol, overriding the routing table. It does not modify the IP header's source or destination address, so it cannot translate a private source address to a public one. NAT configuration uses ip nat inside/outside statements, not route-maps to alter forwarding decisions.
When this WOULD be correct
If the question were framed to ask about directing specific types of traffic from the 192.168.10.0/24 network based on criteria such as source IP or application type, then policy-based routing would be the correct answer. For example, 'An administrator wants to route HTTP traffic from 192.168.10.0/24 through a different gateway than other traffic.'
- ✓
PAT overload
Why this is correct
PAT overload, enabled with the overload keyword on an ip nat inside source rule, maps multiple private IP addresses from 192.168.10.0/24 to a single public address by tracking unique TCP/UDP port numbers. This allows all inside hosts to share the outside interface's IP, which is exactly what the administrator needs to provide internet access without public IP exhaustion. The overload keyword distinguishes it from static NAT by enabling many-to-one translation.
- ✗
Port security
Why it's wrong here
Port security is a Layer 2 switchport feature that restricts ingress traffic by limiting MAC addresses, not a router-based NAT function. It operates on access or trunk ports to mitigate MAC flooding and unauthorized devices, but it does not perform any IP address translation. The scenario involves translating private source addresses for internet access, which is entirely outside the scope of port security.
When this WOULD be correct
If the question were about securing a network by limiting the number of devices that can connect to a switch port, or if it asked how to prevent unauthorized devices from accessing the network, then port security would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓PAT overloadCorrect answer▾
Why this is correct
PAT overload, enabled with the overload keyword on an ip nat inside source rule, maps multiple private IP addresses from 192.168.10.0/24 to a single public address by tracking unique TCP/UDP port numbers. This allows all inside hosts to share the outside interface's IP, which is exactly what the administrator needs to provide internet access without public IP exhaustion. The overload keyword distinguishes it from static NAT by enabling many-to-one translation.
✗Static NATWrong answer — click to see why▾
Why this is wrong here
Static NAT requires a one-to-one mapping between an inside local address and an inside global address, which would consume multiple public IPs if multiple hosts need internet access. It does not allow multiple inside hosts to share a single public IP.
★ When this WOULD be the correct answer
In a scenario where the question states that a specific internal host needs to be consistently reachable from the internet using a fixed public IP, Static NAT would be the correct answer. For example, if the question specified that a web server with IP 192.168.10.10 should always be accessible via the public IP 203.0.113.5, Static NAT would apply.
Why candidates choose this
Students may confuse static NAT with dynamic NAT or PAT because all involve address translation, but static NAT is typically used for servers that need consistent public addresses, not for many hosts sharing one IP.
✗Policy-based routingWrong answer — click to see why▾
Why this is wrong here
Policy-based routing (PBR) is used to override the routing table based on policies (e.g., source/destination IP, protocol), not to perform address translation. It does not modify IP addresses or enable multiple hosts to share a single public IP.
★ When this WOULD be the correct answer
If the question were framed to ask about directing specific types of traffic from the 192.168.10.0/24 network based on criteria such as source IP or application type, then policy-based routing would be the correct answer. For example, 'An administrator wants to route HTTP traffic from 192.168.10.0/24 through a different gateway than other traffic.'
Why candidates choose this
The term 'policy' might lead students to think it involves some form of access control or translation, but PBR is purely a routing mechanism, not a NAT feature.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security is a switchport security feature that restricts MAC addresses allowed on a port to prevent unauthorized access. It does not perform IP address translation or enable internet access for multiple hosts.
★ When this WOULD be the correct answer
If the question were about securing a network by limiting the number of devices that can connect to a switch port, or if it asked how to prevent unauthorized devices from accessing the network, then port security would be the correct answer.
Why candidates choose this
The word 'port' in port security might be confused with the port numbers used in PAT, but port security deals with physical switch ports and MAC addresses, not TCP/UDP port translation.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.