How many NAT and PAT Configuration Scenarios questions are on this page?

This page has 15 NAT and PAT Configuration Scenarios scenario questions for the 200-301 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-301 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to CCNA 200-301 v2 questions

Scenario-based practice

NAT and PAT Configuration Scenarios

Practise 200-301 NAT and PAT questions covering address translation types, inside/outside interface roles, static vs dynamic vs PAT, and troubleshooting missing or incorrect translations.

Start full practice test Read exam guide

scenario questions

200-301

exam code

Cisco

vendor

Scenario guide

How to approach nat and pat configuration scenarios

NAT and PAT questions cover static NAT (one-to-one), dynamic NAT (pool-based), and PAT/overload (many-to-one using port numbers). The CCNA asks you to read NAT table output, fix misconfigured NAT, and match the right NAT type to a scenario.

Quick answer

NAT questions usually test how private addresses are translated, when to use static NAT, dynamic NAT or PAT, and how inside/outside interfaces affect traffic flow.

Static NAT, dynamic NAT and PAT behaviour.

Inside local, inside global, outside local and outside global address meanings.

How NAT affects connectivity between private networks and public destinations.

How to troubleshoot NAT rules, ACL matches and interface direction.

Practice scenarios

Question 1hardmultiple choice

Read the full NAT/PAT explanation →

A small office uses PAT for user Internet access. What mechanism does PAT use to allow many users to share one public address while keeping their sessions distinct?

A
Use transport-layer port values to distinguish multiple inside sessions behind one outside address.
This is correct because PAT uses ports to separate many sessions sharing one public IP.
B
Convert all inside hosts to the same private IP address.
Why wrong: This is wrong because PAT does not require all inside hosts to use the same private address.
C
Increase the size of the NAT pool to include multiple public addresses.
Why wrong: This is wrong because disabling the default route would break Internet access rather than improve PAT.
D
Configure static NAT mappings for each inside host.
Why wrong: This is wrong because switchport trunking does not create PAT behavior.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full NAT/PAT explanation →

Exhibit: Users report no internet access after PAT was configured. The inside and outside interfaces are marked correctly. Which missing configuration is the most likely cause?

Exhibit

Configured:
interface G0/0
 ip nat inside
interface G0/1
 ip nat outside
No translations appear in 'show ip nat translations'.

A
No ACL and nat overload statement identifying inside source addresses
Correct choice.
B
No DHCP pool on the outside interface
Why wrong: Distractor.
C
No CDP enabled on the router
Why wrong: Distractor.
D
No syslog server configured
Why wrong: Distractor.

Full breakdown with real-world context →

Question 3hardScenario

Study the full ACL explanation →

You are connected to R1 in a small office network. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 LAN can access the Internet via the public IP 203.0.113.1 (the IP assigned to interface G0/0). Also configure a static NAT for the internal web server at 192.168.1.10 to the public IP 203.0.113.6. The current configuration has errors: the inside/outside interface assignments are swapped, the ACL for PAT does not match the inside subnet, and the PAT rule points to the wrong ACL. Fix all issues so that both PAT and static NAT work correctly.

Exhibit

R1# show running-config | section ip nat
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.1.10 80 203.0.113.6 80
!
ip nat inside source list 2 interface GigabitEthernet0/0 overload
!
interface GigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.248
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat outside
!
access-list 1 permit 192.168.2.0 0.0.0.255
access-list 2 permit 192.168.1.0 0.0.0.255

A
Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6
This correctly sets the outside interface (G0/0) and inside interface (G0/1), corrects the ACL to match the LAN subnet, and applies PAT using the correct ACL and outside interface. The static NAT is already correctly configured.
B
Configure G0/0 as inside, G0/1 as outside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/1 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6
Why wrong: This is incorrect because the interface assignments are swapped: G0/0 (public) should be outside, not inside. PAT must be applied to the outside interface (G0/0), not G0/1.
C
Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.2.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6
Why wrong: This is incorrect because ACL 1 still permits the wrong subnet (192.168.2.0/24) instead of the correct inside subnet (192.168.1.0/24). PAT would not translate traffic from the LAN.
D
Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 2 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6
Why wrong: This is incorrect because the PAT command references ACL 2, but ACL 2 is not defined or does not match the inside subnet. The correct ACL is ACL 1 after modification.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full NAT/PAT explanation →

A network administrator has configured dynamic NAT on a Cisco router to allow internal hosts to access the Internet. Internal hosts can ping external servers, but external hosts cannot initiate connections to any internal host. The administrator checks the NAT translations. What is the most likely cause of this behavior?

Exhibit

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 203.0.113.10       192.168.1.10       ---                ---
--- 203.0.113.11       192.168.1.11       ---                ---
--- 203.0.113.12       192.168.1.12       ---                ---
--- 203.0.113.13       192.168.1.13       ---                ---
--- 203.0.113.14       192.168.1.14       ---                ---
--- 203.0.113.15       192.168.1.15       ---                ---
--- 203.0.113.16       192.168.1.16       ---                ---
--- 203.0.113.17       192.168.1.17       ---                ---
--- 203.0.113.18       192.168.1.18       ---                ---
--- 203.0.113.19       192.168.1.19       ---                ---
--- 203.0.113.20       192.168.1.20       ---                ---
--- 203.0.113.21       192.168.1.21       ---                ---
--- 203.0.113.22       192.168.1.22       ---                ---
--- 203.0.113.23       192.168.1.23       ---                ---
--- 203.0.113.24       192.168.1.24       ---                ---
--- 203.0.113.25       192.168.1.25       ---                ---
--- 203.0.113.26       192.168.1.26       ---                ---
--- 203.0.113.27       192.168.1.27       ---                ---
--- 203.0.113.28       192.168.1.28       ---                ---
--- 203.0.113.29       192.168.1.29       ---                ---
--- 203.0.113.30       192.168.1.30       ---                ---

A
The NAT pool is exhausted because it contains only 21 addresses, and more than 21 internal hosts are trying to access the Internet simultaneously.
Why wrong: While pool exhaustion is possible, the output shows many translations already, and the symptom is that external hosts cannot initiate connections—a problem that would persist even with a larger pool if overload is not used.
B
The router is configured for dynamic NAT without overload (PAT), so it assigns one public IP per inside host and does not allow inbound connections without a static mapping.
The absence of protocol/port in the translations indicates one-to-one dynamic NAT without overload. This explains why internal hosts can initiate outbound traffic (they get a public IP) but external hosts cannot reach internal hosts (no return path).
C
The inside local addresses are not in the same subnet as the inside interface, causing asymmetric routing.
Why wrong: The inside local addresses (192.168.1.x) are typical private IPs and are assumed to be correctly configured on the inside interface. The translations show them mapping to public IPs, so routing is likely symmetric.
D
The outside global addresses are not routable on the Internet, so external hosts cannot send return traffic.
Why wrong: The public IPs shown (203.0.113.x) are from the TEST-NET-3 range, which is not globally routable. However, this is a common documentation range used in examples; in a real network, these would be replaced with routable IPs. The question assumes they are routable for the scenario.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full NAT/PAT explanation →

A network administrator configured dynamic NAT on a Cisco router to allow internal hosts to access the internet. After the configuration, users report that they can access some websites but not others. The administrator checks the router and discovers that the NAT translation table is full, and new connection attempts are being dropped. What is the most likely cause of this issue?

Exhibit

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---
--- 192.0.2.12         10.0.0.12          ---                ---
--- 192.0.2.13         10.0.0.13          ---                ---
--- 192.0.2.14         10.0.0.14          ---                ---
--- 192.0.2.15         10.0.0.15          ---                ---
--- 192.0.2.16         10.0.0.16          ---                ---
--- 192.0.2.17         10.0.0.17          ---                ---
--- 192.0.2.18         10.0.0.18          ---                ---
--- 192.0.2.19         10.0.0.19          ---                ---

R1# show running-config | include ip nat
ip nat pool MYPOOL 192.0.2.10 192.0.2.19 netmask 255.255.255.240
ip nat inside source list 1 pool MYPOOL

A
The inside local addresses are not properly defined in the access list.
Why wrong: The access list is not shown, but the translations are present, indicating that the access list is matching the correct internal hosts.
B
The NAT pool is exhausted; configure PAT to allow multiple hosts to share a single public IP.
The pool has only 10 addresses, and once all are used, new translations fail. PAT allows many internal hosts to share a single public IP by using unique port numbers.
C
The outside interface is not configured with the ip nat outside command.
Why wrong: If the outside interface were missing this command, no translations would be created at all, but translations are present.
D
The inside interface is not configured with the ip nat inside command.
Why wrong: Similar to option C, translations are present, indicating that the inside interface is correctly configured.

Full breakdown with real-world context →

Question 6hardScenario

Read the full NAT/PAT explanation →

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to an ISP router at 10.0.0.2/30. The internal network has a web server at 192.168.1.10 and a mail server at 192.168.1.20. You need to configure NAT so that internal hosts can access the internet (PAT overload) and external users can reach the web server via public IP 203.0.113.10 and the mail server via public IP 203.0.113.11. The inside interface is GigabitEthernet0/1 (192.168.1.1/24) and the outside interface is GigabitEthernet0/0.

A
ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255 interface GigabitEthernet0/1 ip nat inside interface GigabitEthernet0/0 ip nat outside ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80 extendable ip nat inside source static tcp 192.168.1.20 25 203.0.113.11 25 extendable
This configuration correctly defines an ACL to match internal traffic, sets the NAT interfaces, enables PAT overload using the outside interface IP, and creates static NAT entries for the web and mail servers. The 'extendable' keyword allows multiple static translations to the same public IP if needed.
B
ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255 interface GigabitEthernet0/1 ip nat outside interface GigabitEthernet0/0 ip nat inside ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80 ip nat inside source static tcp 192.168.1.20 25 203.0.113.11 25
Why wrong: This configuration incorrectly assigns the NAT interface directions: the inside interface (Gig0/1) is marked as 'outside' and the outside interface (Gig0/0) as 'inside'. This would cause NAT to fail because traffic from internal hosts would not be translated correctly.
C
ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255 interface GigabitEthernet0/1 ip nat inside interface GigabitEthernet0/0 ip nat outside ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload ip nat inside source static 192.168.1.10 203.0.113.10 ip nat inside source static 192.168.1.20 203.0.113.11
Why wrong: This configuration omits the protocol and port in the static NAT entries. Without specifying TCP and port numbers, the static NAT would apply to all traffic (including non-HTTP/SMTP) and could conflict with PAT. Also, the 'extendable' keyword is missing, which is recommended when using PAT alongside static NAT.
D
ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255 interface GigabitEthernet0/1 ip nat inside interface GigabitEthernet0/0 ip nat outside ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload ip nat outside source static tcp 203.0.113.10 80 192.168.1.10 80 ip nat outside source static tcp 203.0.113.11 25 192.168.1.20 25
Why wrong: This configuration uses 'ip nat outside source static' instead of 'ip nat inside source static'. The 'outside source static' command translates the source address of packets coming from the outside, which is not the correct method for mapping external public IPs to internal servers. The correct command is 'ip nat inside source static'.

Full breakdown with real-world context →

Question 7mediumdrag order

Read the full NAT/PAT explanation →

Drag and drop the following steps into the correct order to configure PAT (overload) on a Cisco router using a single public IP address on the outside interface.

A
Enter global configuration mode
All configuration changes must be performed from global configuration mode.
B
Create an access list to match the traffic to be translated
Defines which internal source IP addresses will be eligible for PAT.
C
Configure the inside interface with 'ip nat inside'
Identifies the interface connecting to the internal network for NAT operations.
D
Configure the outside interface with 'ip nat outside'
Identifies the interface connecting to the external network for NAT operations.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full NAT/PAT explanation →

A branch router is configured for NAT overload. The inside interface Gi0/0 is correctly marked ip nat inside, and the outside interface Gi0/1 is ip nat outside. The NAT statement uses access-list 1 permit 10.1.1.0 0.0.0.255 with ip nat inside source list 1 interface Gi0/1 overload. Inside hosts are in the 192.168.1.0/24 subnet and still reach the ISP with their private addresses. What is the most likely reason?

Exhibit

access-list 1 permit 10.10.20.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload

interface GigabitEthernet0/0
 ip address 198.51.100.2 255.255.255.252
 ip nat outside

interface GigabitEthernet0/1
 ip address 10.10.10.1 255.255.255.0
 ip nat inside

Users are in 10.10.10.0/24.

A
The ACL used for NAT does not match the inside client subnet.
The overload statement references ACL 1, but ACL 1 permits 10.10.20.0/24 instead of 10.10.10.0/24.
B
GigabitEthernet0/0 should be configured as ip nat inside.
Why wrong: The ISP-facing interface is correctly marked outside.
C
PAT cannot use an interface address as the translated source.
Why wrong: That is exactly how NAT overload commonly works.
D
The router must run OSPF before NAT overload can function.
Why wrong: NAT does not require OSPF.

Full breakdown with real-world context →

Question 9mediumdrag order

Read the full NAT/PAT explanation →

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router and describe the translation process for an outbound packet.

A
Enter global configuration mode, mark inside and outside interfaces, create a pool of global addresses, then enable PAT with overload.
This is the correct order for configuring PAT on a Cisco IOS-XE router. First, you enter global configuration mode. Then you mark the inside and outside interfaces using 'ip nat inside' and 'ip nat outside'. Next, you create a pool of global addresses using 'ip nat pool'. Finally, you enable PAT with the 'overload' keyword to allow multiple inside hosts to share the pool addresses.
B
Create a pool of global addresses, mark inside and outside interfaces, enter global configuration mode, then enable PAT with overload.
This is incorrect because you must enter global configuration mode before marking interfaces or creating the pool. The order is wrong; you cannot create a pool or mark interfaces without first being in the correct configuration mode.
C
Mark inside and outside interfaces, enter global configuration mode, enable PAT with overload, then create a pool of global addresses.
This is incorrect because you must enter global configuration mode before marking interfaces. Also, the pool must be created before enabling PAT with overload, as the overload command references the pool.
D
Enter global configuration mode, enable PAT with overload, create a pool of global addresses, then mark inside and outside interfaces.
Why wrong: This is incorrect because the inside and outside interfaces must be marked before enabling PAT. The NAT configuration requires the interfaces to be identified as inside or outside for the translation to work correctly.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full NAT/PAT explanation →

Refer to the exhibit. Users on the inside network can browse the web, but return traffic is failing for some sessions. A partial configuration shows:

interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat outside

interface GigabitEthernet0/1
 ip address 203.0.113.10 255.255.255.0
 ip nat inside

ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.10.0 0.0.0.255

Based on this configuration, which change is required to make PAT work correctly?

Exhibit

interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/1
 ip address 203.0.113.10 255.255.255.252
 ip nat inside
!
access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload

A
Apply ip nat enable on both interfaces.
Why wrong: `ip nat enable` is not the normal Cisco IOS syntax used for classic inside/outside NAT in this scenario. The directional role assignment is what needs correction.
B
Replace overload with pool.
Why wrong: Using a pool is another NAT design option, but it is not required for PAT to work. The current command already uses interface overload, which is valid. The failure is caused by reversed inside and outside roles.
C
Swap the inside and outside NAT roles on the two interfaces.
This is correct because NAT depends on the router knowing which side is private and which side is public. The current configuration labels them the wrong way round. PAT with overload on the WAN interface is fine, but the interface roles must match the traffic direction.
D
Change access-list 1 to a standard ACL numbered 100.
Why wrong: Standard ACL 1 is already valid for identifying inside local addresses. There is no requirement to use ACL 100 for this kind of NAT rule. The bigger issue is that the interfaces are assigned the wrong NAT roles.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full NAT/PAT explanation →

A router is configured for NAT overload, but translations never appear when inside users browse the internet. Which issue is most likely?

Exhibit

ip nat inside source list 10 interface g0/0 overload
access-list 10 permit 192.168.10.0 0.0.0.255
!
interface g0/0
 ip address 203.0.113.2 255.255.255.252
!
interface g0/1
 ip address 192.168.10.1 255.255.255.0
 ip nat inside

A
The outside interface is missing the ip nat outside command
Without inside and outside roles, overload translations will not build correctly.
B
The ACL used by NAT must deny inside addresses
Why wrong: The NAT ACL should usually match the inside local addresses to be translated.
C
PAT requires DHCP on the inside interface
Why wrong: PAT does not require DHCP.
D
NAT overload works only with OSPF-learned routes
Why wrong: NAT is independent of the routing protocol choice.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full NAT/PAT explanation →

A network administrator is troubleshooting an issue where hosts in the 192.168.20.0/24 subnet cannot reach the Internet, while hosts in 192.168.10.0/24 can. The router is configured for PAT overload using a dynamic pool on the outside interface. The administrator collects the configuration shown in the exhibit. What is the most likely cause of the connectivity problem for the 192.168.20.0/24 subnet?

Exhibit

R1#show running-config | section access-list|ip nat|interface GigabitEthernet0/1|interface GigabitEthernet0/2|interface GigabitEthernet0/0
access-list 10 permit 192.168.10.0 0.0.0.255
access-list 20 permit 192.168.20.0 0.0.0.0
ip nat pool NAT-POOL 200.1.1.1 200.1.1.2 netmask 255.255.255.252
ip nat inside source list 10 pool NAT-POOL overload
ip nat inside source list 20 pool NAT-POOL overload
interface GigabitEthernet0/0
 ip address 200.1.1.1 255.255.255.252
 ip nat outside
interface GigabitEthernet0/1
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
interface GigabitEthernet0/2
 ip address 192.168.20.1 255.255.255.0
 ip nat inside

A
The wildcard mask in access list 20 is incorrect; it matches only the network address.
Access list 20 uses mask 0.0.0.0, which matches only the single address 192.168.20.0. To encompass the entire 192.168.20.0/24 subnet, the mask must be 0.0.0.255.
B
The NAT pool does not have enough IP addresses to support both subnets.
Why wrong: Overload (PAT) allows many inside local addresses to share a single global address by multiplexing ports, so two addresses in the pool are more than sufficient.
C
Interface GigabitEthernet0/2 is missing the ip nat inside command.
Why wrong: The exhibit clearly shows the command 'ip nat inside' applied to GigabitEthernet0/2.
D
Access list 10 is incorrectly applied to the NAT pool, causing a conflict.
Why wrong: Both access lists are correctly mapped to the same pool with 'overload', and there is no configuration conflict; list 10 works fine for the 192.168.10.0/24 subnet.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full NAT/PAT explanation →

A router is performing PAT for inside users. Which detail allows multiple inside sessions to share one public IPv4 address at the same time?

A
Use of transport-layer port numbers to distinguish sessions
This is correct because PAT relies on port values to multiplex many sessions through one public address.
B
Replacement of all MAC addresses with broadcast addresses
Why wrong: This is wrong because PAT does not rely on broadcast MAC addressing.
C
Automatic conversion of every subnet into a /32
Why wrong: This is wrong because PAT does not work by changing subnet masks to /32.
D
Requirement that every inside host use the same private IP address
Why wrong: This is wrong because PAT does not require identical private addresses on all hosts.

Full breakdown with real-world context →

Question 14mediumdrag order

Read the full NAT/PAT explanation →

Drag and drop the following steps into the correct order to configure dynamic NAT with overload (PAT) using a pool of public IP addresses.

Question 15hardScenario

Read the full NAT/PAT explanation →

You are connected to R1. The inside network 192.168.1.0/24 must be able to reach the internet via PAT (overload) using the public IP 203.0.113.1 on interface GigabitEthernet0/1. Additionally, a web server at 192.168.1.10 must be reachable from the internet via static NAT to 203.0.113.10. The current configuration is not working. Identify and fix all issues.

Exhibit

R1# show running-config | section ip nat
ip nat inside source list 100 interface GigabitEthernet0/1
ip nat inside source static 192.168.1.10 203.0.113.10
!
R1# show running-config | section interface
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
R1# show access-lists 100
Standard IP access list 100
    10 permit 192.168.2.0 0.0.0.255

A
Change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.
This is correct because it fixes all three issues: the ACL now matches the correct inside network, the 'overload' keyword enables PAT, and verification confirms NAT is working.
B
Change ACL 100 to permit 192.168.1.0 0.0.0.255 and add the 'overload' keyword to the ip nat inside source list command.
Why wrong: This is incorrect because it omits the verification step; while the configuration changes are correct, verification is essential to confirm the fix works.
C
Add the 'overload' keyword to the ip nat inside source list command and verify with 'show ip nat translations'.
Why wrong: This is incorrect because it does not address the ACL issue; the ACL still permits the wrong network (192.168.2.0/24), so inside traffic from 192.168.1.0/24 will not be translated.
D
Change ACL 100 to permit 192.168.1.0 0.0.0.255 and verify with 'show ip nat translations'.
Why wrong: This is incorrect because it does not add the 'overload' keyword; without 'overload', PAT is not enabled, and only one inside host can use the public IP at a time.

Full breakdown with real-world context →

These 200-301 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 200-301 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

NAT and PAT Configuration Scenarios

How to approach nat and pat configuration scenarios

Quick answer

Related 200-301 topic practice pages

Network Infrastructure and Connectivity practice questions

Switching and Network Access practice questions

IP Routing practice questions

Network Services and Security practice questions

AI and Network Operations practice questions

CCNA subnetting practice questions

CCNA OSPF practice questions

CCNA VLAN practice questions

CCNA STP practice questions

CCNA EtherChannel practice questions

CCNA ACL practice questions

CCNA NAT practice questions

Practice scenarios

A small office uses PAT for user Internet access. What mechanism does PAT use to allow many users to share one public address while keeping their sessions distinct?

Exhibit: Users report no internet access after PAT was configured. The inside and outside interfaces are marked correctly. Which missing configuration is the most likely cause?

Exhibit

Exhibit

Exhibit

Exhibit

Drag and drop the following steps into the correct order to configure PAT (overload) on a Cisco router using a single public IP address on the outside interface.

Exhibit

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router and describe the translation process for an outbound packet.

Exhibit

A router is configured for NAT overload, but translations never appear when inside users browse the internet. Which issue is most likely?

Exhibit

Exhibit

A router is performing PAT for inside users. Which detail allows multiple inside sessions to share one public IPv4 address at the same time?

Drag and drop the following steps into the correct order to configure dynamic NAT with overload (PAT) using a pool of public IP addresses.

Exhibit