CCNA Network Services and Security Practice Question
Exhibit
interface GigabitEthernet0/0 ip address 192.168.10.1 255.255.255.0 ip nat outside interface GigabitEthernet0/1 ip address 203.0.113.2 255.255.255.252 ip nat inside access-list 1 permit 192.168.10.0 0.0.0.255 ip nat inside source list 1 interface GigabitEthernet0/1 overload
Hosts on the inside network can reach the internet, but return traffic is failing after a new router was installed. The router's configuration shows that the LAN-facing interface has been configured with 'ip nat outside' and the WAN-facing interface with 'ip nat inside'. What configuration mistake is the most likely cause?
⚠ Common exam trap
A frequent exam trap is reversing the NAT inside and outside interface roles. Candidates may see that hosts can initiate traffic to the internet and mistakenly assume NAT is correctly configured. However, if the router’s interfaces are misassigned, return traffic from the internet will not be translated back to the inside hosts, causing connectivity failures. This trap exploits the partial functionality of NAT where outbound packets appear to succeed but inbound packets fail, leading to confusion during troubleshooting and exam scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT inside and outside interface roles are reversed.
NAT overload requires the LAN-facing interface to be marked as ip nat inside and the WAN-facing interface as ip nat outside. The exhibit shows those roles reversed, so translations will not occur correctly. The ACL itself is fine for matching the inside subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The NAT inside and outside interface roles are reversed.
Why this is correct
Cisco NAT requires the interface connected to the internal network (where private IP addresses reside) to be configured with 'ip nat inside', and the interface connected to the public network (the internet) with 'ip nat outside'. The scenario describes the LAN-facing interface as 'ip nat outside' and the WAN-facing interface as 'ip nat inside'. This reversal prevents the router from correctly translating the source private IP addresses of outbound traffic into a public IP. Consequently, return traffic from the internet, destined for the public IP, cannot be reverse-translated and routed back to the internal hosts, satisfying the constraint that return traffic is failing.
- ✗
The ACL must deny RFC1918 traffic before NAT can work.
Why it's wrong here
The access-list used with ip nat inside source is not a traffic filter; it defines which inside local addresses are eligible for translation. RFC1918 private addresses are precisely the addresses that must be matched and translated, so denying them would stop outbound NAT from ever occurring. The enterprise's real fault is labeling the LAN interface as ip nat outside and the WAN interface as ip nat inside, which prevents any translation regardless of ACL content.
When this WOULD be correct
In a different scenario where a question states that NAT is configured but only private IP addresses are being routed to the internet, and the ACL is explicitly set to deny RFC1918 addresses, this option would be correct. It would imply that the ACL is blocking necessary traffic for NAT to operate.
- ✗
PAT cannot use an interface address for overload.
Why it's wrong here
Cisco IOS explicitly supports PAT with the overload keyword using the outside interface's own IP address as the translated source address. For example, ip nat inside source list 1 interface Serial0/0/0 overload is a standard configuration for sharing one public IP among many internal clients. Therefore, the inability to reach the internet is not caused by using an interface address for PAT; it is caused by incorrectly assigning ip nat inside and ip nat outside to the WAN and LAN interfaces, respectively.
When this WOULD be correct
In a scenario where a question specifies that PAT is configured incorrectly and explicitly states that it cannot use an interface address for overload, this option would be correct. For example, if the question describes a setup where multiple internal hosts are trying to access the internet but are configured to use the router's interface address directly without proper overload settings.
- ✗
The inside subnet must be configured as /24 on both interfaces.
Why it's wrong here
Cisco NAT does not require the inside and outside interfaces to share a subnet mask or even belong to the same IP network. The LAN-facing interface normally uses a private /24 subnet, while the WAN-facing interface uses a public address from the ISP's different subnet; a /24 mask on the WAN link is not a design requirement. The actual problem here is that the NAT interface roles are reversed, not that the subnet masks are misconfigured.
When this WOULD be correct
In a different scenario where a question specifies that both the inside and outside interfaces must have the same subnet mask for proper routing and NAT to function, option D would be correct. For example, if the question states that mismatched subnet masks are causing routing issues, then this option would be valid.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The NAT inside and outside interface roles are reversed.Correct answer▾
Why this is correct
Cisco NAT requires the interface connected to the internal network (where private IP addresses reside) to be configured with 'ip nat inside', and the interface connected to the public network (the internet) with 'ip nat outside'. The scenario describes the LAN-facing interface as 'ip nat outside' and the WAN-facing interface as 'ip nat inside'. This reversal prevents the router from correctly translating the source private IP addresses of outbound traffic into a public IP. Consequently, return traffic from the internet, destined for the public IP, cannot be reverse-translated and routed back to the internal hosts, satisfying the constraint that return traffic is failing.
✗The ACL must deny RFC1918 traffic before NAT can work.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because ACLs do not need to deny RFC1918 traffic for NAT to function properly; NAT can handle private IP addresses without additional ACL configurations. The issue here is more likely related to NAT interface roles.
★ When this WOULD be the correct answer
In a different scenario where a question states that NAT is configured but only private IP addresses are being routed to the internet, and the ACL is explicitly set to deny RFC1918 addresses, this option would be correct. It would imply that the ACL is blocking necessary traffic for NAT to operate.
Why candidates choose this
Candidates may find this option tempting because they might recall that ACLs can impact NAT operations, leading them to mistakenly believe that denying private addresses is a necessary step for NAT to function properly.
✗PAT cannot use an interface address for overload.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because PAT (Port Address Translation) can indeed use an interface address for overload, as it is designed to allow multiple hosts to share a single public IP address by differentiating traffic based on port numbers.
★ When this WOULD be the correct answer
In a scenario where a question specifies that PAT is configured incorrectly and explicitly states that it cannot use an interface address for overload, this option would be correct. For example, if the question describes a setup where multiple internal hosts are trying to access the internet but are configured to use the router's interface address directly without proper overload settings.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of PAT functionality, thinking that it cannot use the interface address, especially if they confuse it with static NAT configurations that require specific mappings.
✗The inside subnet must be configured as /24 on both interfaces.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because the subnet mask configuration does not directly affect NAT functionality; NAT can operate with different subnet masks as long as the routing is correctly set up. The issue here is related to the NAT interface roles, not the subnet mask.
★ When this WOULD be the correct answer
In a different scenario where a question specifies that both the inside and outside interfaces must have the same subnet mask for proper routing and NAT to function, option D would be correct. For example, if the question states that mismatched subnet masks are causing routing issues, then this option would be valid.
Why candidates choose this
Candidates may choose this option because they associate NAT functionality with subnet configurations, believing that consistent subnet masks are essential for NAT operations, leading to confusion about the specific requirements for NAT to function correctly.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.