Static NAT for Inbound Server, PAT for Outbound Users
Users on the inside network can browse the web, but the company now needs an internal web server at 192.168.10.50 to be reachable consistently from outside using one public IP address. Which design is most appropriate?
Quick Answer
The answer is to use static NAT for the server and continue using PAT for outbound users. This design is correct because static NAT provides a fixed one-to-one mapping between the public IP and the internal server at 192.168.10.50, ensuring consistent inbound reachability from outside, while PAT allows many inside users to share a single public address for outbound web browsing, conserving the limited public IP pool. On the CCNA 200-301 v2 exam, this question tests your ability to distinguish between address translation methods for different traffic flows—a common trap is assuming one method fits all, but the exam emphasizes that static NAT solves predictability for inbound servers and PAT solves address conservation for outbound clients. Remember the memory tip: "Static for service, PAT for people."
⚠ Common exam trap
A common exam trap is selecting PAT for both outbound and inbound traffic, mistakenly believing PAT can provide a stable public IP for a server. PAT dynamically assigns ports for outbound sessions but does not guarantee a fixed public IP and port combination for inbound connections. This leads to unpredictable external access to the internal server, which fails the requirement for consistent reachability. Another trap is disabling NAT entirely, which ignores that private IPv4 addresses are not routable on the public Internet, making the server unreachable externally. Misunderstanding DHCP relay as a solution for public reachability is also a frequent error, as DHCP relay only forwards DHCP requests and does not affect NAT or routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use static NAT for the server and continue using PAT for user outbound access.
The best design is static NAT for the server while continuing to use PAT for general user outbound traffic. In plain language, user browsing and server publishing are two different requirements. PAT is great for letting many inside users share one public address for outbound access. But a server that outside clients must find reliably needs a fixed one-to-one public identity. That is exactly what static NAT provides. This is an important design distinction. PAT solves address conservation for many clients. Static NAT solves predictability for inbound access to a specific internal system. The strongest answer is the one that uses each NAT method for the job it fits best.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use static NAT for the server and continue using PAT for user outbound access.
Why this is correct
This is correct because static NAT provides a stable public mapping for the server, while PAT still supports many outbound users.
- ✗
Use PAT only for everything, including the published server.
Why it's wrong here
This is wrong because PAT does not provide the same predictable one-to-one public identity expected for a published server.
When this WOULD be correct
In a scenario where all internal services, including web servers, are designed to be accessed externally without needing a consistent IP address for each service, and the organization is comfortable with dynamic port assignments, using PAT for everything could be appropriate.
- ✗
Disable NAT because private IPv4 addresses are Internet-routable.
Why it's wrong here
This is wrong because private IPv4 addresses are not routable on the public Internet.
When this WOULD be correct
In a scenario where a company is transitioning to IPv6 and has fully migrated its internal network to use public IPv6 addresses, disabling NAT could be correct. The question would specify that the internal web server uses a public IPv6 address, making it routable on the Internet without NAT.
- ✗
Use DHCP relay for the server to make it reachable from outside.
Why it's wrong here
This is wrong because DHCP relay is unrelated to public reachability for the server.
When this WOULD be correct
If the question were about configuring a network where internal clients need to obtain IP addresses dynamically from a DHCP server located on a different subnet, and the focus was solely on ensuring internal clients can reach the DHCP server, then using DHCP relay would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use static NAT for the server and continue using PAT for user outbound access.Correct answer▾
Why this is correct
This is correct because static NAT provides a stable public mapping for the server, while PAT still supports many outbound users.
✗Use PAT only for everything, including the published server.Wrong answer — click to see why▾
Why this is wrong here
Using PAT only for everything, including the published server, is incorrect because PAT does not allow external users to reach a specific internal server consistently; it translates multiple internal IPs to a single public IP, which can lead to conflicts and accessibility issues.
★ When this WOULD be the correct answer
In a scenario where all internal services, including web servers, are designed to be accessed externally without needing a consistent IP address for each service, and the organization is comfortable with dynamic port assignments, using PAT for everything could be appropriate.
Why candidates choose this
Candidates may choose this option because they understand that PAT is commonly used for outbound connections and might mistakenly believe it can also handle inbound requests effectively without recognizing the limitations for server accessibility.
✗Disable NAT because private IPv4 addresses are Internet-routable.Wrong answer — click to see why▾
Why this is wrong here
Disabling NAT would prevent the internal web server from being accessible from the outside, as private IPv4 addresses are not routable on the Internet. This option fails to meet the requirement of making the server reachable consistently from outside.
★ When this WOULD be the correct answer
In a scenario where a company is transitioning to IPv6 and has fully migrated its internal network to use public IPv6 addresses, disabling NAT could be correct. The question would specify that the internal web server uses a public IPv6 address, making it routable on the Internet without NAT.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of NAT's role in network design, believing that eliminating NAT would simplify access to internal resources without recognizing the implications for private address routing.
✗Use DHCP relay for the server to make it reachable from outside.Wrong answer — click to see why▾
Why this is wrong here
Using DHCP relay does not directly facilitate external access to an internal server; it merely forwards DHCP requests and does not address the requirement for the server to be consistently reachable from outside using a public IP.
★ When this WOULD be the correct answer
If the question were about configuring a network where internal clients need to obtain IP addresses dynamically from a DHCP server located on a different subnet, and the focus was solely on ensuring internal clients can reach the DHCP server, then using DHCP relay would be appropriate.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of DHCP relay's function, confusing it with NAT solutions that manage external access, leading them to think it could help with server reachability.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Static NAT
Static Network Address Translation (NAT) is a one-to-one mapping between a private IP address and a public IP address that never changes.
Key term
find
The find command in Unix/Linux is a powerful utility for searching files and directories based on a wide range of criteria such as name, size, type, permissions, and modification time.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-301
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A branch office uses PAT overload on the edge router. Inside users can reach the internet, but return traffic for a newly deployed server must be mapped to a specific inside host. Which two statements are correct?
medium- ✓ A.A static NAT entry can provide a consistent public-to-private mapping for the server
- ✓ B.PAT overload is designed mainly for many-to-one outbound address sharing
- C.Dynamic NAT always supports inbound access without additional configuration
- D.NAT is unrelated to whether private addresses can reach the public internet
Why A: PAT overload is great for many inside clients sharing a public IP for outbound sessions. A public-facing server that needs predictable inbound reachability typically requires static NAT or static PAT.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.