CCNA Network Services and Security Practice Question
Exhibit
ip nat inside source list 10 interface g0/1 access-list 10 permit 10.10.10.0 0.0.0.255 G0/0 = inside G0/1 = outside
Inside hosts can reach the internet only one at a time. What is the most likely NAT issue?
⚠ Common exam trap
A frequent exam trap is assuming that reversing the inside and outside interface roles causes the symptom of only one host accessing the internet at a time. While interface roles are critical for NAT operation, reversing them typically prevents translation altogether rather than limiting it to a single host. Another trap is thinking that the ACL should deny the inside subnet to fix the issue, but denying the inside subnet in the ACL stops all translations, causing no internet access. The real cause is missing the overload keyword, which is essential for PAT to allow multiple hosts to share one public IP simultaneously.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT statement is missing the overload keyword
Without overload, dynamic NAT uses one public address per internal session mapping. PAT with overload is what lets many inside hosts share a single outside interface address at the same time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The NAT statement is missing the overload keyword
Why this is correct
The NAT configuration lacks the overload keyword, which enables Port Address Translation (PAT). Without overload, the router performs one-to-one dynamic NAT, mapping each inside host to a unique public IP address. If only one public IPv4 address is available, only one host can be translated at a time, producing the one-at-a-time connectivity behavior described. Adding overload lets many inside hosts share that single public address by multiplexing on source port.
- ✗
The access list should deny the inside subnet
Why it's wrong here
The access list in the NAT statement defines which inside source addresses are eligible for translation; denying the inside subnet would exclude all internal hosts from translation entirely. That would stop NAT for every host, so neither one nor multiple hosts could reach the internet. The observed problem is not a total block but a limitation in concurrent translations, so modifying the ACL to deny the inside subnet would eliminate connectivity rather than resolve the one-at-a-time issue.
When this WOULD be correct
In a different scenario where the question states that internal hosts should not be allowed to access the internet at all, an access list denying the inside subnet would be the correct answer. This would be relevant in a security-focused question where restricting access is the goal.
- ✗
The inside and outside interface roles are reversed in the exhibit
Why it's wrong here
If the inside and outside interface roles were reversed, NAT would examine traffic in the wrong direction and would not translate source addresses for outbound connections. This would typically prevent any inside host from reaching the internet, or cause translations to be applied to inbound traffic, not an intermittent one-at-a-time pattern. The symptom of hosts reaching the internet sequentially indicates that translation is occurring for individual flows, pointing to a lack of overload rather than a complete interface misconfiguration.
When this WOULD be correct
In a different scenario, if a question presented a network diagram where the interfaces were explicitly labeled as inside and outside but were incorrectly configured in the NAT settings, then this option could be correct. For example, if the NAT configuration was applied to the outside interface instead of the inside, it would cause NAT to fail.
- ✗
NAT cannot be used with RFC1918 addresses
Why it's wrong here
NAT is specifically designed to translate RFC1918 private addresses (such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) to public, routable addresses, making this a standard and common use case. The exhibit clearly shows private addressing on the inside, which is exactly the scenario that NAT and PAT are intended to support. The issue is not the NAT mechanism itself but the missing overload keyword, which prevents multiple private hosts from sharing a single public IP simultaneously.
When this WOULD be correct
In a different exam scenario where the question specifies that NAT is being configured for public IP addresses only, and the context indicates that the use of private addresses is not allowed, this option could be correct. For example, if the question states that only public IPs are permitted for NAT, then option D would be valid.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The NAT statement is missing the overload keywordCorrect answer▾
Why this is correct
The NAT configuration lacks the overload keyword, which enables Port Address Translation (PAT). Without overload, the router performs one-to-one dynamic NAT, mapping each inside host to a unique public IP address. If only one public IPv4 address is available, only one host can be translated at a time, producing the one-at-a-time connectivity behavior described. Adding overload lets many inside hosts share that single public address by multiplexing on source port.
✗The access list should deny the inside subnetWrong answer — click to see why▾
Why this is wrong here
The access list in NAT configuration is used to identify which traffic should be translated, not to deny traffic. Denying the inside subnet would prevent any translation for those hosts, causing them to have no internet access at all, rather than allowing one at a time.
★ When this WOULD be the correct answer
In a different scenario where the question states that internal hosts should not be allowed to access the internet at all, an access list denying the inside subnet would be the correct answer. This would be relevant in a security-focused question where restricting access is the goal.
Why candidates choose this
A student might think that the access list controls which hosts can use NAT, and incorrectly assume that denying the subnet would limit access to one host at a time. However, the symptom of 'one at a time' is classic for missing overload, not access list misconfiguration.
✗The inside and outside interface roles are reversed in the exhibitWrong answer — click to see why▾
Why this is wrong here
If the inside and outside interfaces were reversed, internal hosts would not be able to reach the internet at all because the router would not translate their source addresses correctly. The symptom of 'one at a time' specifically indicates that translation is happening but only for one host, which is a PAT issue, not an interface role reversal.
★ When this WOULD be the correct answer
In a different scenario, if a question presented a network diagram where the interfaces were explicitly labeled as inside and outside but were incorrectly configured in the NAT settings, then this option could be correct. For example, if the NAT configuration was applied to the outside interface instead of the inside, it would cause NAT to fail.
Why candidates choose this
Students often confuse interface roles in NAT configuration. The symptom of limited connectivity might lead them to suspect a misconfiguration of inside/outside interfaces, but the 'one at a time' behavior is a hallmark of missing overload, not reversed interfaces.
✗NAT cannot be used with RFC1918 addressesWrong answer — click to see why▾
Why this is wrong here
NAT is specifically designed to translate RFC1918 private addresses to public addresses for internet access. Using NAT with RFC1918 addresses is a standard and common practice in virtually all enterprise networks.
★ When this WOULD be the correct answer
In a different exam scenario where the question specifies that NAT is being configured for public IP addresses only, and the context indicates that the use of private addresses is not allowed, this option could be correct. For example, if the question states that only public IPs are permitted for NAT, then option D would be valid.
Why candidates choose this
A student might recall that RFC1918 addresses are private and not routable on the internet, and mistakenly think that NAT cannot be used with them. However, NAT is the solution that allows these addresses to communicate with the internet.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.