mediumMultiple Choice
CCNP Practice Question: Examine the following configuration snippet…
Examine the following configuration snippet applied to a Cisco IOS-XE device:
interface GigabitEthernet0/1 ip address 10.1.1.1 255.255.255.0 ip nat inside
!
interface GigabitEthernet0/2 ip address 192.168.1.1 255.255.255.0 ip nat outside
!
access-list 100 permit ip 10.1.1.0 0.0.0.255 any ip nat inside source list 100 interface GigabitEthernet0/2 overload
What is the effect of this configuration?
⚠ Common exam trap
It's easy for candidates to confuse dynamic NAT with overload (PAT) against static NAT, and reversing the inside/outside direction — candidates who see 'ip nat inside source' and assume a one-to-one mapping pick static NAT, while those who misread the interface roles pick the reversed translation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It translates all IP traffic from 10.1.1.0/24 to the IP address 192.168.1.1 using port address translation.
The configuration uses 'ip nat inside source list 100 interface GigabitEthernet0/2 overload', which is dynamic NAT with PAT (overload). ACL 100 matches all traffic sourced from 10.1.1.0/24, and the 'overload' keyword enables port address translation so many inside hosts share the single outside interface IP 192.168.1.1. Therefore all IP traffic from 10.1.1.0/24 is translated to 192.168.1.1 using PAT.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It translates all IP traffic from 10.1.1.0/24 to the IP address 192.168.1.1 using port address translation.
Why this is correct
Port address translation is enabled by the **overload** keyword, which lets many inside hosts share the single outside address 192.168.1.1 by multiplexing sessions across unique source port numbers. Access-list 100 matches the 10.1.1.0/24 source range, satisfying the requirement to translate all inside traffic to that interface address.
- ✗
It performs static NAT for the host 10.1.1.1 to 192.168.1.1.
Why it's wrong here
The overload keyword with a source list produces dynamic PAT, not a one-to-one static mapping; 10.1.1.1 is the inside interface address, not a translated host. It is tempting because static NAT also maps addresses, but it requires ip nat inside source static.
- ✗
It translates all traffic from 192.168.1.0/24 to the IP address 10.1.1.1.
Why it's wrong here
The access list permits 10.1.1.0/24, and GigabitEthernet0/1 is the inside interface, so translation applies to that subnet, not 192.168.1.0/24. It is tempting because 192.168.1.1 is the outside address, but overload translates inside sources to it.
- ✗
It allows all IP traffic from any source to any destination without translation.
Why it's wrong here
Access-list 100 permits only 10.1.1.0/24, and the ip nat inside source statement applies translation to matching traffic; other traffic is not translated but is also not generally permitted by this ACL. It is tempting because ACLs can filter traffic, but this one only selects NAT candidates.
Visual reference
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.