CCNA Network Services and Security Practice Question
Exhibit
Observed symptom: - Internal users can reach internal routes - Internet browsing fails - Private source addresses are still seen on outbound WAN traffic
Users in a branch office can reach internal networks but cannot browse the Internet. The router has a correct default route and PAT is configured. Which missing item is the most likely cause if inside hosts are still using private source addresses on the WAN?
⚠ Common exam trap
A common exam trap is assuming that configuring a default route and enabling PAT alone guarantees Internet access for inside hosts. Candidates often overlook the necessity of a correct NAT ACL or source match that explicitly identifies which inside local addresses should be translated. Without this ACL, the router forwards packets with private IP addresses unchanged, causing return traffic to fail because upstream devices reject packets with non-routable source addresses. This mistake leads to the false conclusion that routing or PAT is misconfigured, when the real issue is the missing or incorrect NAT match.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A correct ACL or source match identifying inside local addresses for NAT
If inside hosts are still appearing with private source addresses on the WAN side, the most likely missing element is a correct NAT inside source match for the internal subnet. In plain language, the router knows where Internet traffic should go because the default route exists, but it is not actually translating the private addresses before sending the traffic out. That means upstream devices see RFC 1918 private addresses that are not valid on the public Internet and return traffic fails. This is a common CCNA troubleshooting pattern: routing and NAT are separate functions. A valid default route only tells the router where to send packets. It does not automatically translate them. PAT also depends on a correct ACL or source match identifying which inside addresses should be translated. If that match is missing or wrong, the router forwards the traffic but without performing the necessary translation. That is why the missing or incorrect NAT match is the most likely root cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A correct ACL or source match identifying inside local addresses for NAT
Why this is correct
PAT (NAT overload) relies on an access list or route map to identify which inside local source addresses are eligible for translation. If that match is missing or incorrect, the router has a route for the internal networks and will forward the packets, but it never rewrites the source to the public address. As a result, private addresses are sent out the WAN unmodified, and return traffic cannot be routed back, which exactly matches the reported symptom.
- ✗
An STP root bridge election on the WAN side
Why it's wrong here
STP root bridge election is a Layer 2 loop-prevention mechanism that operates only within switched LAN segments; it has no involvement in IP packet forwarding or NAT at a routed WAN edge. Root bridge election on the WAN side would alter the active switching topology but would not affect whether the router translates private source addresses. Therefore, an STP issue cannot explain why inside users can reach internal networks but their traffic leaves the WAN with un-translated private IPs.
When this WOULD be correct
In a different scenario, if the question involved issues with VLANs and STP configurations affecting traffic flow between multiple switches, a candidate might need to identify the root bridge to ensure proper traffic forwarding, making this option relevant.
- ✗
A voice VLAN on the branch access switches
Why it's wrong here
A voice VLAN is an access-layer switch feature that carries VoIP telephone traffic in a separate 802.1Q-tagged VLAN to separate data and voice traffic and apply QoS policies. Misconfiguring a voice VLAN could break phone registration or call quality, but it does not interact with the NAT process on the WAN router. Since the symptom concerns source-address translation of all user traffic, a voice VLAN design flaw is not a plausible root cause.
When this WOULD be correct
In a different scenario where the question specifies that voice traffic is prioritized over data traffic and there are issues with voice traffic not reaching the WAN, a voice VLAN could be the correct answer if the configuration of the VLAN is misconfigured, preventing proper communication.
- ✗
A loopback interface with a higher IP address
Why it's wrong here
A loopback interface is a virtual interface typically used for management, a router ID, or a stable source address for routing protocols; its IP address is not automatically used as the outside translation address for NAT. Even if a loopback has a higher IP address, NAT overload still requires an explicit inside-to-outside interface mapping and a `ip nat outside` configuration on the actual WAN interface. Therefore, a loopback interface cannot enable PAT and does not explain the missing translation of private sources.
When this WOULD be correct
In a scenario where the question asks about routing issues or path selection in a network where multiple loopback interfaces exist, a loopback interface with a higher IP address could be the correct answer if it is being used as a next-hop address for routing decisions, affecting connectivity.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓A correct ACL or source match identifying inside local addresses for NATCorrect answer▾
Why this is correct
PAT (NAT overload) relies on an access list or route map to identify which inside local source addresses are eligible for translation. If that match is missing or incorrect, the router has a route for the internal networks and will forward the packets, but it never rewrites the source to the public address. As a result, private addresses are sent out the WAN unmodified, and return traffic cannot be routed back, which exactly matches the reported symptom.
✗An STP root bridge election on the WAN sideWrong answer — click to see why▾
Why this is wrong here
An STP root bridge election on the WAN side does not affect NAT functionality; it pertains to Layer 2 network topology and traffic flow rather than IP address translation. Therefore, it cannot explain why inside hosts are using private addresses on the WAN.
★ When this WOULD be the correct answer
In a different scenario, if the question involved issues with VLANs and STP configurations affecting traffic flow between multiple switches, a candidate might need to identify the root bridge to ensure proper traffic forwarding, making this option relevant.
Why candidates choose this
Candidates may mistakenly associate STP with connectivity issues, believing that problems in Layer 2 could impact Layer 3 operations like NAT, leading them to select this option despite its irrelevance to the question.
✗A voice VLAN on the branch access switchesWrong answer — click to see why▾
Why this is wrong here
A voice VLAN on the branch access switches does not directly impact the ability of internal hosts to access the Internet. This option is unrelated to NAT configuration or routing issues that would prevent private addresses from being translated to public addresses.
★ When this WOULD be the correct answer
In a different scenario where the question specifies that voice traffic is prioritized over data traffic and there are issues with voice traffic not reaching the WAN, a voice VLAN could be the correct answer if the configuration of the VLAN is misconfigured, preventing proper communication.
Why candidates choose this
Candidates may confuse VLAN configurations with routing issues, thinking that any misconfiguration related to VLANs could affect overall network connectivity, leading them to mistakenly select this option.
✗A loopback interface with a higher IP addressWrong answer — click to see why▾
Why this is wrong here
A loopback interface with a higher IP address does not directly influence the NAT process or the ability of inside hosts to reach the Internet. NAT relies on the correct configuration of ACLs and source address translations, not on the loopback interface's IP address.
★ When this WOULD be the correct answer
In a scenario where the question asks about routing issues or path selection in a network where multiple loopback interfaces exist, a loopback interface with a higher IP address could be the correct answer if it is being used as a next-hop address for routing decisions, affecting connectivity.
Why candidates choose this
Candidates may be tempted by this option due to a misunderstanding of how routing and NAT interact, thinking that the loopback interface's configuration might influence the NAT process or connectivity to external networks.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
Key term
WAN
A Wide Area Network (WAN) is a telecommunications network that connects multiple smaller networks, like local area networks, across large geographical distances.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.