CCNP Practice Question: Is configuring NAT overload (PAT) on a Cisco…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The access list 1 is too permissive and includes the public IP address of the router.

  Why it's wrong here

  While a permissive ACL may match more inside hosts than intended, including the router's own public IP in access list 1 does not directly exhaust the NAT translation table. PAT only translates traffic sourced from inside local addresses that enters the inside interface, so packets sourced from the outside/public IP would rarely traverse that path. Even if it did, this would be a constant misconfiguration causing consistent behavior, not sporadic translation failures tied to session volume.

• ✓

  The NAT translation table is filling up due to a large number of concurrent sessions, causing new translations to be denied.

  Why this is correct

  With Port Address Translation (PAT), a single public IP can support at most about 65,000 simultaneous translations because each session must use a unique source port (1–65535, minus reserved). When the router's NAT table reaches this limit, it drops new connection attempts, denying translations for additional inside hosts. As existing sessions age out or are cleared, the table frees ports, allowing new connections to succeed, which matches the intermittent failure pattern described. High concurrent sessions—common with web browsing, streaming, or file transfers—can easily fill the table.

• ✗

  The router is not configured with ip nat inside on the internal interface.

  Why it's wrong here

  The 'ip nat inside' command marks the interface where inside local addresses are sourced before translation. If it were missing from the internal interface, no traffic arriving on that interface would be translated at all — every inside host would fail to reach the Internet, not just intermittently. With PAT, a missing 'ip nat inside' would also produce a persistent, total outage rather than a table-filling condition. Thus, this configuration error cannot explain sporadic connectivity.

• ✗

  The overload keyword is misspelled or not supported on this IOS version.

  Why it's wrong here

  The 'overload' keyword is a standard, widely supported IOS parameter that enables PAT; if it were misspelled, the router would reject the command with a syntax error during configuration, not silently malfunction. An unsupported keyword on an older IOS version would similarly cause a configuration rejection, not allow the NAT rule to install and then behave unpredictably. Consequently, the session-dependent failures described are not consistent with a keyword that was never accepted by the router.