CCNA Network Services and Security Practice Question
Exhibit
`ip nat inside source static 192.168.1.50 203.0.113.50`
A router has this command configured: `ip nat inside source static 192.168.1.50 203.0.113.50`. What is the main effect of this configuration?
⚠ Common exam trap
A common exam trap is mistaking static NAT for PAT or dynamic NAT. Candidates may incorrectly assume that the command enables PAT overload, allowing many internal users to share one public IP, but static NAT provides a fixed one-to-one mapping without port translation. Another trap is thinking static NAT blocks inbound traffic; in reality, it enables inbound access to the mapped inside host. Misunderstanding these differences can lead to selecting incorrect answers about NAT behavior and configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It creates a permanent one-to-one translation between the inside host and a public address
This command creates a static NAT mapping between one inside local address and one inside global address. In plain language, the internal device at 192.168.1.50 will always appear as 203.0.113.50 to the outside world. That fixed relationship is useful when a particular internal host or service must be reachable consistently from outside networks. This is different from PAT, which shares one public address across many sessions using ports. Static NAT is one-to-one and predictable. It does not dynamically pull from a pool in this syntax. The key idea is permanence: the same inside device is always mapped to the same outside address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It creates a permanent one-to-one translation between the inside host and a public address
Why this is correct
This command creates a permanent one-to-one mapping between a single inside local IP address (192.168.1.50) and a fixed inside global public IP address. The translation is inserted statically and remains in the NAT table until manually deleted, allowing bidirectional traffic initiation. This distinguishes it from dynamic NAT, which uses a pool and times out.
- ✗
It enables PAT overload for all internal users
Why it's wrong here
PAT overload requires the 'overload' keyword along with a dynamic NAT pool or interface, enabling many internal addresses to share one public IP using unique source port numbers. The given command uses 'static' and therefore references only one inside host, not the entire internal network. It cannot provide Internet access for multiple users concurrently.
When this WOULD be correct
In a different question, if the command were `ip nat inside source list 1 interface Serial0 overload`, it would enable PAT for all internal users, allowing multiple devices to share a single public IP address through port numbers.
- ✗
It blocks inbound access to the inside host permanently
Why it's wrong here
Static NAT does not apply any security filtering; it merely advertises a public IP that maps to an inside host, and inbound packets are forwarded to that host. Restricting inbound access would require an access control list or firewall rule applied to the interface. Therefore, this statement confuses NAT behavior with packet filtering.
When this WOULD be correct
If the question were about a firewall configuration that explicitly denies all inbound traffic to a specific host, then stating that it blocks inbound access would be correct. For example, a question could ask about a firewall rule that drops all packets destined for a specific internal IP.
- ✗
It changes the host subnet mask to a public prefix
Why it's wrong here
NAT translation operates on IP packet headers as they traverse the router, altering the source or destination IP address. It does not modify the host's locally configured subnet mask, which remains part of the host's IP stack and is used for direct or gateway-based delivery. Subnet mask changes would require reconfiguration on the host itself.
When this WOULD be correct
If the question were about a command that explicitly modifies the IP address configuration of a device, such as `ip address 203.0.113.50 255.255.255.0`, then this option would be correct, as it would indicate that the host's subnet mask is being changed to a public prefix.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓It creates a permanent one-to-one translation between the inside host and a public addressCorrect answer▾
Why this is correct
This command creates a permanent one-to-one mapping between a single inside local IP address (192.168.1.50) and a fixed inside global public IP address. The translation is inserted statically and remains in the NAT table until manually deleted, allowing bidirectional traffic initiation. This distinguishes it from dynamic NAT, which uses a pool and times out.
✗It enables PAT overload for all internal usersWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because the command `ip nat inside source static` creates a static NAT entry, not PAT (Port Address Translation), which is used for multiple internal users sharing a single public IP address.
★ When this WOULD be the correct answer
In a different question, if the command were `ip nat inside source list 1 interface Serial0 overload`, it would enable PAT for all internal users, allowing multiple devices to share a single public IP address through port numbers.
Why candidates choose this
Candidates may confuse static NAT with PAT due to their similar purposes in network address translation, leading them to incorrectly assume that the command enables overload for multiple users.
✗It blocks inbound access to the inside host permanentlyWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because the command `ip nat inside source static` does not block inbound access; instead, it allows inbound traffic to the specified inside host using the mapped public address.
★ When this WOULD be the correct answer
If the question were about a firewall configuration that explicitly denies all inbound traffic to a specific host, then stating that it blocks inbound access would be correct. For example, a question could ask about a firewall rule that drops all packets destined for a specific internal IP.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of NAT concepts, confusing the static mapping with security features that restrict access to internal hosts.
✗It changes the host subnet mask to a public prefixWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because the command does not change the subnet mask of the host; it only creates a static NAT mapping between a private IP and a public IP.
★ When this WOULD be the correct answer
If the question were about a command that explicitly modifies the IP address configuration of a device, such as `ip address 203.0.113.50 255.255.255.0`, then this option would be correct, as it would indicate that the host's subnet mask is being changed to a public prefix.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of NAT concepts, conflating NAT operations with IP address configuration changes, leading them to believe that NAT inherently modifies subnet masks.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
Key term
Port Address Translation
A networking technique that maps multiple private IP addresses and their ports to a single public IP address using unique port numbers.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.