CCNA Network Services and Security Practice Question
Exhibit
ip nat inside source static 192.168.20.10 198.51.100.10 interface g0/0 ip nat outside ip access-group OUTSIDE-IN in
Exhibit: Hosts on the inside network can reach the internet, but inbound connections to a published web server fail. Static NAT is configured. What is the most likely missing piece?
⚠ Common exam trap
Many candidates assume that static NAT alone guarantees inbound access, forgetting that an inbound ACL on the outside interface must explicitly permit the traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An ACL permit entry allowing TCP port 80 or 443 to the translated address
Static NAT provides the address translation, but traffic still must be permitted by an inbound ACL or firewall policy on the outside interface. Option A is incorrect because a default route on the inside host affects outbound traffic, not inbound connections. Option C is wrong since PAT overload is for many-to-one translation and is not required here, and it would not block inbound traffic if static NAT is already configured. Option D is incorrect because DHCP relay does not influence inbound access to a web server; it only forwards DHCP requests from clients to a remote DHCP server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A default route on the inside host
Why it's wrong here
A default route on an inside host only controls how that host sends its outbound traffic to a default gateway. The symptom is that outside clients cannot reach the web server, which is an inbound direction problem handled by the router's routing table and ACLs. Since the exhibit states the inside network can already reach the internet, the inside hosts already have a valid path or default route, making this option redundant and irrelevant to the inbound failure.
When this WOULD be correct
In a scenario where the question specifies that hosts on the inside network cannot reach any external resources, and the configuration is missing a default route on the inside host, this option would be correct. For example, if the question stated that internal users cannot access the internet at all, then a default route would be necessary.
- ✓
An ACL permit entry allowing TCP port 80 or 443 to the translated address
Why this is correct
Static NAT creates the one-to-one mapping between the public IP and the web server's private IP, but packet filtering is applied independently of the translation. An inbound ACL on the outside interface must explicitly permit TCP ports 80/443 destined to the translated (public) address; without that permit, the router silently drops the HTTP/HTTPS packets even though the NAT entry exists. This permit entry is the missing piece that completes the inbound web access path.
- ✗
PAT overload on the outside interface
Why it's wrong here
PAT overload is designed for many-to-one source translation of outbound sessions, allowing multiple internal hosts to share one public IP. In a static server-publish scenario, you need a static one-to-one NAT mapping for the web server, and PAT does not create an inbound association that would bypass an ACL. Additionally, applying PAT on the outside interface would not permit inbound TCP 80/443 traffic unless an ACL allows it, so it leaves the actual problem unsolved.
When this WOULD be correct
In a different scenario where multiple internal hosts need to share a single public IP address for outbound connections, a question might ask about the configuration needed to enable this. In that case, the correct answer could be PAT overload on the outside interface to allow multiple hosts to access the internet simultaneously.
- ✗
DHCP relay toward the web server
Why it's wrong here
DHCP relay is a feature that forwards DHCP broadcast messages between clients and servers across different subnets, typically for dynamic IP address assignment. The issue here is inbound HTTP/HTTPS traffic being dropped by the router's ACL, which has no connection to DHCP at all. Adding a DHCP relay would neither create the necessary NAT translation nor add an ACL permit, so it cannot help external clients reach the published web server.
When this WOULD be correct
In a different scenario where a web server is on a different subnet and requires DHCP for IP assignment, a question might ask about enabling communication between the server and clients. In this case, a DHCP relay would be necessary to forward DHCP requests from clients to the server's subnet.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓An ACL permit entry allowing TCP port 80 or 443 to the translated addressCorrect answer▾
Why this is correct
Static NAT creates the one-to-one mapping between the public IP and the web server's private IP, but packet filtering is applied independently of the translation. An inbound ACL on the outside interface must explicitly permit TCP ports 80/443 destined to the translated (public) address; without that permit, the router silently drops the HTTP/HTTPS packets even though the NAT entry exists. This permit entry is the missing piece that completes the inbound web access path.
✗A default route on the inside hostWrong answer — click to see why▾
Why this is wrong here
A default route on the inside host is not relevant to the failure of inbound connections to the web server; it only affects outbound traffic. The issue here is related to access control for incoming connections, not routing on the inside host.
★ When this WOULD be the correct answer
In a scenario where the question specifies that hosts on the inside network cannot reach any external resources, and the configuration is missing a default route on the inside host, this option would be correct. For example, if the question stated that internal users cannot access the internet at all, then a default route would be necessary.
Why candidates choose this
Candidates may confuse the need for proper routing with the issue of inbound connections, leading them to believe that a default route is necessary for all types of connectivity, including inbound traffic.
✗PAT overload on the outside interfaceWrong answer — click to see why▾
Why this is wrong here
PAT overload on the outside interface is not relevant to the failure of inbound connections to a published web server, as static NAT is already configured for the server's IP address. PAT is used for dynamic address translation, which does not apply here.
★ When this WOULD be the correct answer
In a different scenario where multiple internal hosts need to share a single public IP address for outbound connections, a question might ask about the configuration needed to enable this. In that case, the correct answer could be PAT overload on the outside interface to allow multiple hosts to access the internet simultaneously.
Why candidates choose this
Candidates may choose this option because they associate NAT configurations with address translation and might overlook the specific context of static NAT versus PAT, leading to confusion about their roles in inbound and outbound traffic.
✗DHCP relay toward the web serverWrong answer — click to see why▾
Why this is wrong here
DHCP relay is not relevant in this scenario because it pertains to forwarding DHCP requests, not facilitating inbound connections to a web server. The issue here is related to NAT and access control, not IP address assignment.
★ When this WOULD be the correct answer
In a different scenario where a web server is on a different subnet and requires DHCP for IP assignment, a question might ask about enabling communication between the server and clients. In this case, a DHCP relay would be necessary to forward DHCP requests from clients to the server's subnet.
Why candidates choose this
Candidates may confuse DHCP relay with general network connectivity issues, mistakenly believing that it could help resolve inbound connection problems to a web server, especially if they have encountered similar scenarios in their studies.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.