CCNA Network Services and Security Practice Question
Users on the inside network can browse the Internet through PAT, but an internal web server must now be reachable from outside on a predictable public IP. Which change best fits the requirement?
⚠ Common exam trap
A frequent exam trap is selecting DHCP relay or VLAN changes as solutions for making an internal server reachable from outside. DHCP relay only forwards DHCP requests across subnets and does not provide any public IP mapping or NAT functionality. Similarly, moving a server into the native VLAN does not affect its public IP address or NAT translation. Another common mistake is disabling NAT entirely, which breaks Internet connectivity because private IP addresses cannot be routed on the public Internet. Understanding that static NAT is required for predictable inbound access while PAT supports outbound user browsing is critical to avoid these traps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add static NAT for the server and continue using PAT for user browsing.
The best change is to add a static NAT mapping for the internal web server while keeping PAT in place for ordinary users. In practical terms, PAT is excellent for many internal clients sharing one public address for outbound traffic, but it does not give an internal server the stable one-to-one public identity that outside clients expect for predictable inbound access. This is a standard NAT design distinction. User browsing and published server access are different requirements, and the best design often uses PAT for one and static NAT for the other.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add static NAT for the server and continue using PAT for user browsing.
Why this is correct
Static NAT is required to give the internal server a one-to-one mapping to a public IPv4 address, making it reachable from the Internet while preserving its private address. PAT (overload) should remain enabled to translate many internal user sessions to the same public IP for outbound browsing. These two translation mechanisms can coexist in a single NAT configuration, with the router selecting static NAT for the server's destination and PAT for user traffic.
- ✗
Replace PAT entirely with DHCP relay.
Why it's wrong here
DHCP relay is a broadcast-forwarding mechanism that allows DHCP clients on one subnet to obtain lease information from a DHCP server on another subnet; it has no role in address translation or Internet reachability. Replacing PAT with DHCP relay would remove NAT entirely, so internal users would send packets with their private source addresses. Those private addresses are not routable across the public Internet, so all user browsing would fail, and the server would remain equally inaccessible from outside.
When this WOULD be correct
In a scenario where a network is configured to use DHCP for assigning IP addresses to devices, and there is a need to allow external clients to access a specific server without using NAT, a question might ask how to configure the network to allow external access while maintaining DHCP functionality. In that case, replacing PAT with DHCP relay could be the correct answer.
- ✗
Disable NAT because the server already has a private address.
Why it's wrong here
Disabling NAT because the server already has a private address is incorrect because RFC 1918 private addresses are designed to be non-routable on the public Internet. Without NAT, the server's outbound packets would be dropped by upstream routers, and external clients would have no way to send inbound traffic to that private address. NAT is the mechanism that translates between private and public addressing; removing it would isolate both the server and all internal users from the Internet.
When this WOULD be correct
In a scenario where a question asks about a network configuration where all internal devices need to communicate directly with each other without any address translation, disabling NAT could be the correct answer to simplify the network and avoid unnecessary complexity.
- ✗
Move the server into the native VLAN.
Why it's wrong here
The native VLAN is the VLAN that carries untagged traffic on an 802.1Q trunk, used for switch-to-switch or switch-to-router links and often for management protocols. Moving a server into the native VLAN only changes its Layer 2 domain; it does not assign any public IP address or create an address translation entry. Internet publishing requires a routable public address or NAT mapping, not a particular VLAN assignment, so this action has no effect on external access.
When this WOULD be correct
In a scenario where the question specifies that the server needs to be accessible by internal users only and that VLAN configurations are being reviewed for internal traffic optimization, moving the server into the native VLAN could enhance internal communication without requiring NAT.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Add static NAT for the server and continue using PAT for user browsing.Correct answer▾
Why this is correct
Static NAT is required to give the internal server a one-to-one mapping to a public IPv4 address, making it reachable from the Internet while preserving its private address. PAT (overload) should remain enabled to translate many internal user sessions to the same public IP for outbound browsing. These two translation mechanisms can coexist in a single NAT configuration, with the router selecting static NAT for the server's destination and PAT for user traffic.
✗Replace PAT entirely with DHCP relay.Wrong answer — click to see why▾
Why this is wrong here
Replacing PAT with DHCP relay does not address the requirement of making an internal web server reachable from the outside. DHCP relay is used for forwarding DHCP requests and does not facilitate NAT or public IP address assignment.
★ When this WOULD be the correct answer
In a scenario where a network is configured to use DHCP for assigning IP addresses to devices, and there is a need to allow external clients to access a specific server without using NAT, a question might ask how to configure the network to allow external access while maintaining DHCP functionality. In that case, replacing PAT with DHCP relay could be the correct answer.
Why candidates choose this
Candidates may confuse the need for external access with the need for IP address management, leading them to believe that DHCP relay could somehow facilitate external connectivity, despite it being unrelated to NAT functions.
✗Disable NAT because the server already has a private address.Wrong answer — click to see why▾
Why this is wrong here
Disabling NAT would prevent the internal web server from being accessible from the outside, as it would eliminate the necessary translation of the private IP to a public IP, which is required for external access.
★ When this WOULD be the correct answer
In a scenario where a question asks about a network configuration where all internal devices need to communicate directly with each other without any address translation, disabling NAT could be the correct answer to simplify the network and avoid unnecessary complexity.
Why candidates choose this
Candidates may be tempted by this option because they might believe that since the server has a private address, it can be accessed directly without NAT, overlooking the requirement for external accessibility.
✗Move the server into the native VLAN.Wrong answer — click to see why▾
Why this is wrong here
Moving the server into the native VLAN does not address the requirement for external accessibility via a predictable public IP. The server would still need static NAT to be reachable from the outside, regardless of its VLAN placement.
★ When this WOULD be the correct answer
In a scenario where the question specifies that the server needs to be accessible by internal users only and that VLAN configurations are being reviewed for internal traffic optimization, moving the server into the native VLAN could enhance internal communication without requiring NAT.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of VLANs and their role in network segmentation, believing that simply changing VLANs can resolve accessibility issues without considering NAT requirements.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.