How many NAT and PAT Configuration Scenarios questions are on this page?

This page has 15 NAT and PAT Configuration Scenarios scenario questions for the 350-401 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-401 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ENCOR 350-401 questions

Scenario-based practice

NAT and PAT Configuration Scenarios

Practise 350-401 NAT and PAT questions covering address translation types, inside/outside interface roles, static vs dynamic vs PAT, and troubleshooting missing or incorrect translations.

Start full practice test Read exam guide

scenario questions

350-401

exam code

Cisco

vendor

Scenario guide

How to approach nat and pat configuration scenarios

NAT and PAT questions cover static NAT (one-to-one), dynamic NAT (pool-based), and PAT/overload (many-to-one using port numbers). The CCNA asks you to read NAT table output, fix misconfigured NAT, and match the right NAT type to a scenario.

Quick answer

NAT questions usually test how private addresses are translated, when to use static NAT, dynamic NAT or PAT, and how inside/outside interfaces affect traffic flow.

Static NAT, dynamic NAT and PAT behaviour.

Inside local, inside global, outside local and outside global address meanings.

How NAT affects connectivity between private networks and public destinations.

How to troubleshoot NAT rules, ACL matches and interface direction.

Practice scenarios

Question 1mediumdrag order

Read the full VRF explanation →

Drag and drop the steps of VRF-aware NAT configuration for path isolation into the correct order, from first to last.

Question 2hardmultiple choice

Read the full NAT/PAT explanation →

A network engineer issues the following command on Router R6:

R6# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.168.1.100 10.0.0.10 --- --- --- 192.168.1.101 10.0.0.11 --- --- udp 192.168.1.100:1234 10.0.0.10:1234 203.0.113.5:53 203.0.113.5:53 tcp 192.168.1.101:80 10.0.0.11:80 198.51.100.2:443 198.51.100.2:443

Based on this output, what is true about the NAT translations?

A
All translations are static NAT entries.
Why wrong: Static NAT would show a consistent mapping; here we see dynamic translations with ports.
B
The translation for 10.0.0.10 to 192.168.1.100 is a dynamic NAT without PAT.
The first two entries have no protocol or port, indicating a simple one-to-one dynamic NAT. The later entries show PAT with ports.
C
The router is performing only PAT (overload).
Why wrong: Both dynamic NAT and PAT are present.
D
The outside global address is the same for all translations.
Why wrong: Outside global addresses differ (203.0.113.5 and 198.51.100.2).

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full NAT/PAT explanation →

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat outside

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside

access-list 1 permit 192.168.1.0 0.0.0.255

ip nat inside source list 1 interface GigabitEthernet0/0 overload

What is the effect of this configuration?

A
All traffic from 192.168.1.0/24 will be translated to the IP address of GigabitEthernet0/0 using PAT.
Correct. The 'overload' keyword enables PAT, translating multiple inside hosts to a single outside IP.
B
Only one host from 192.168.1.0/24 can access the internet at a time.
Why wrong: Incorrect. PAT allows multiple hosts to share the same IP address by using different port numbers.
C
Traffic from the outside interface will be translated to 192.168.1.0/24.
Why wrong: Incorrect. This is source NAT; destination NAT would require 'ip nat outside source'.
D
The configuration will fail because the access list must be applied to an interface.
Why wrong: Incorrect. The access list is referenced by the NAT command and does not need to be applied to an interface.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full NAT/PAT explanation →

A network engineer is configuring a Cisco router to provide internet access to a small office using a single public IP address assigned by the ISP. The engineer wants to allow internal hosts to initiate connections to the internet, but also needs to make a web server on the internal network reachable from the internet. The engineer configures a standard access list for NAT and an ip nat inside source list command. However, external users cannot reach the internal web server. What is the most likely cause?

A
The access list used for NAT does not permit the web server's IP address.
Why wrong: Incorrect because the access list is used to identify which inside local addresses are eligible for translation; it does not affect static mappings.
B
The engineer forgot to add the ip nat inside source static command for the web server.
Correct because a static NAT entry is required to map the public IP to the internal web server's private IP, allowing inbound connections.
C
The ip nat inside and ip nat outside commands are applied on the wrong interfaces.
Why wrong: Incorrect because the scenario does not indicate an interface misapplication; the issue is the lack of a static mapping.
D
The global configuration mode is missing the ip nat pool command.
Why wrong: Incorrect because a pool is not required for static NAT; it is used for dynamic NAT with multiple addresses.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full NAT/PAT explanation →

A network engineer is troubleshooting a NAT issue where an internal host cannot establish an SSH session to a remote server on the internet. The engineer checks the NAT translations on the border router and sees that the translation for the host's source IP is present. However, the SSH session times out. The engineer also notices that the remote server's IP is not in the NAT translation table. What is the most likely cause?

A
The router is performing NAT only for the source IP, but the return traffic is taking a different path that does not go through the NAT router.
Correct because if the return traffic does not pass through the same NAT router, the router will not create an inbound translation entry, and the packet will not be translated back to the private IP.
B
The SSH server is blocking connections from the public IP address.
Why wrong: Incorrect because the SSH session would still attempt to establish; the timeout indicates a routing/translation issue, not a firewall block.
C
The NAT overload is causing port conflicts for SSH.
Why wrong: Incorrect because SSH uses a specific port (22), and PAT can handle multiple SSH sessions by using different source ports.
D
The access list used for NAT is denying the SSH traffic.
Why wrong: Incorrect because if the access list denied SSH, no translation would be created at all.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full NAT/PAT explanation →

A network engineer is configuring NAT overload (PAT) on a Cisco router to allow multiple internal hosts to share a single public IP address. The engineer uses the command ip nat inside source list 1 interface GigabitEthernet0/0 overload. After testing, internal hosts can access the internet, but some applications fail intermittently. The engineer suspects a NAT issue. What is the most likely cause?

A
The access list 1 is too permissive and includes the public IP address of the router.
Why wrong: Incorrect because including the public IP in the access list would not cause intermittent failures; it might cause unnecessary translations but not port exhaustion.
B
The NAT translation table is filling up due to a large number of concurrent sessions, causing new translations to be denied.
Correct because PAT has a limited number of available port numbers (approximately 65,000 per public IP), and if many sessions are active, the table can become full, dropping new connections.
C
The router is not configured with ip nat inside on the internal interface.
Why wrong: Incorrect because if the inside interface were missing the command, no translations would occur at all, not just intermittent failures.
D
The overload keyword is misspelled or not supported on this IOS version.
Why wrong: Incorrect because the overload keyword is standard for PAT; a misspelling would cause a syntax error, not intermittent failures.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full NAT/PAT explanation →

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source list 100 interface GigabitEthernet0/0 overload, where access list 100 permits only the 10.0.0.0/8 network. After testing, hosts in the 10.0.0.0/8 network can access the internet, but hosts in the 172.16.0.0/16 network cannot. The engineer verifies that the 172.16.0.0/16 hosts have connectivity to the router. What is the most likely cause?

A
The access list 100 does not permit the 172.16.0.0/16 network.
Correct because the NAT configuration only translates traffic that matches the access list; hosts not in the list are not translated.
B
The router's interface GigabitEthernet0/0 is not configured with ip nat outside.
Why wrong: Incorrect because if the outside interface were missing the command, no translations would work at all.
C
The 172.16.0.0/16 hosts have a default gateway pointing to a different router.
Why wrong: Incorrect because the engineer verified connectivity to the router, implying the default gateway is correct.
D
The NAT pool is exhausted for the 172.16.0.0/16 network.
Why wrong: Incorrect because the configuration uses overload (PAT), which does not require a pool; it uses the interface IP.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full NAT/PAT explanation →

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source static tcp 192.168.1.10 80 203.0.113.1 80. After testing, external users can access the internal web server using the public IP. However, internal hosts cannot access the web server using the public IP. What is the most likely cause?

A
The router does not have NAT hairpinning enabled, so internal traffic to the public IP is not translated.
Correct because by default, Cisco routers do not perform NAT for traffic that enters and leaves the same interface (inside-to-inside). This requires the ip nat enable route-map or similar configuration.
B
The static NAT entry is missing the extendable keyword.
Why wrong: Incorrect because the extendable keyword is used when multiple static NAT entries share the same public IP; it is not related to hairpinning.
C
The internal hosts have a route to the public IP via the router's outside interface.
Why wrong: Incorrect because even with a route, the NAT translation would not occur for inside-to-inside traffic without hairpinning.
D
The access list used for NAT is blocking internal traffic.
Why wrong: Incorrect because the static NAT entry does not use an access list; it is a direct mapping.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full NAT/PAT explanation →

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- ---

Based on this output, what can be concluded?

A
Dynamic NAT is configured with a pool of addresses.
Why wrong: Dynamic NAT entries would show protocol and timers; this output shows static entries without protocol.
B
Static NAT is configured for two internal hosts.
The absence of protocol and the presence of inside global/local pairs indicate static NAT.
C
PAT is translating multiple internal addresses to a single global address.
Why wrong: PAT would show the same inside global address with different ports; here each inside global is unique.
D
NAT is not operational because no outside local addresses are shown.
Why wrong: Static NAT entries do not require outside local addresses to be displayed in this output.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full NAT/PAT explanation →

A network engineer runs the following command on Router R5:

R5# show ip nat translations

Pro Inside global Inside local Outside local Outside global udp 192.0.2.20:1234 10.0.0.20:1234 203.0.113.1:53 203.0.113.1:53 tcp 192.0.2.20:5678 10.0.0.20:5678 198.51.100.1:80 198.51.100.1:80

Based on this output, what can be concluded?

A
The router is configured with static NAT for two internal hosts.
Why wrong: Static NAT would not show ports; this is PAT with dynamic translations.
B
The router is performing Port Address Translation (PAT) for multiple sessions from the same internal host.
Same inside global IP with different ports indicates PAT.
C
The router is performing destination NAT.
Why wrong: Destination NAT would show different outside local/global pairs; here they match.
D
The inside local address 10.0.0.20 is using two different global addresses.
Why wrong: Both translations use the same inside global address 192.0.2.20.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full NAT/PAT explanation →

A network engineer runs the following command on Router R9:

R9# show ip nat translations

Pro Inside global Inside local Outside local Outside global udp 192.0.2.20:1234 10.0.0.20:1234 203.0.113.1:53 203.0.113.1:53 tcp 192.0.2.20:5678 10.0.0.20:5678 198.51.100.1:80 198.51.100.1:80 --- 192.0.2.21 10.0.0.21 --- ---

Based on this output, what can be concluded?

A
All translations are dynamic.
Why wrong: The third entry has no protocol, indicating it is static.
B
The router is using both static NAT and PAT simultaneously.
Static NAT for 10.0.0.21 and PAT for 10.0.0.20 are both active.
C
The router is configured with a single NAT pool.
Why wrong: Static NAT does not use a pool; PAT may use a pool or interface.
D
The inside global address 192.0.2.20 is used for both static and dynamic translations.
Why wrong: 192.0.2.20 is used only for dynamic PAT; static uses 192.0.2.21.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full NAT/PAT explanation →

A network engineer runs the following command on Router R3:

R3# show ip nat statistics

Total active translations: 5 (0 static, 5 dynamic; 5 extended) Outside interfaces: GigabitEthernet0/0 Inside interfaces: GigabitEthernet0/1 Hits: 1234 Misses: 5 CEF Translated packets: 1200, CEF Punted packets: 34 Expired translations: 10 Dynamic mappings: -- Inside Source

[Id] ip nat pool POOL1 203.0.113.1 203.0.113.10 netmask 255.255.255.240

refcount 5

Based on this output, what can be concluded?

A
The NAT pool has exhausted all available addresses.
Why wrong: Only 5 of 10 addresses are used, so the pool is not exhausted.
B
The NAT translations are all static.
Why wrong: The output shows 0 static and 5 dynamic translations.
C
The router is performing Port Address Translation (PAT).
The translations are 'extended', which indicates PAT is being used.
D
The inside interface is GigabitEthernet0/0.
Why wrong: The inside interface is GigabitEthernet0/1; outside is GigabitEthernet0/0.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full NAT/PAT explanation →

A network engineer runs the following command on Router R7:

R7# show ip nat translations verbose

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:05:00 timeout: never, flags: static --- 192.0.2.11 10.0.0.11 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:06:00 timeout: never, flags: static

Based on this output, what can be concluded?

A
These translations will expire after a configurable timeout.
Why wrong: The timeout is 'never', so they do not expire.
B
The translations are dynamic and will be removed after idle timeout.
Why wrong: The flags indicate 'static', not dynamic.
C
The router is performing PAT for these addresses.
Why wrong: No protocol or port is shown; these are simple static NAT entries.
D
The translations are static and will remain until manually removed.
Static NAT entries with timeout 'never' persist indefinitely.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full NAT/PAT explanation →

Given this NAT configuration: ```

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat inside

interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.0
 ip nat outside

ip nat inside source static 10.0.0.5 198.51.100.5

``` What is the purpose of this configuration?

A
It translates all traffic from 10.0.0.0/24 to 198.51.100.0/24 using PAT.
Why wrong: Incorrect. This is static NAT for a single host, not dynamic PAT for the entire subnet.
B
It creates a one-to-one mapping between 10.0.0.5 and 198.51.100.5, allowing inbound and outbound traffic.
Correct. Static NAT provides a fixed mapping for both directions.
C
It translates only outbound traffic from 10.0.0.5 to 198.51.100.5.
Why wrong: Incorrect. Static NAT also translates inbound traffic to the inside host.
D
The configuration is incomplete; it needs an access-list.
Why wrong: Incorrect. Static NAT does not require an access-list.

Full breakdown with real-world context →

Question 15easymultiple choice

Read the full NAT/PAT explanation →

Which type of NAT translates multiple inside addresses to a single outside address using different port numbers?

A
Static NAT
Why wrong: Incorrect. Static NAT is one-to-one mapping.
B
Dynamic NAT
Why wrong: Incorrect. Dynamic NAT without overload also uses one-to-one mapping from a pool.
C
Port Address Translation (PAT)
Correct. PAT uses port numbers to multiplex multiple inside addresses to a single outside address.
D
Policy NAT
Why wrong: Incorrect. Policy NAT matches traffic based on extended ACLs but does not inherently multiplex ports.

Full breakdown with real-world context →

These 350-401 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-401 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

NAT and PAT Configuration Scenarios

How to approach nat and pat configuration scenarios

Quick answer

Related 350-401 topic practice pages

Architecture practice questions

Enterprise Network Design practice questions

SD-Access Architecture practice questions

SD-WAN Architecture practice questions

QoS Architecture practice questions

Virtualization practice questions

Network Function Virtualization practice questions

Virtual Machines and Hypervisors practice questions

VRF and Path Isolation practice questions

Infrastructure practice questions

OSPF practice questions

BGP practice questions

Practice scenarios

Drag and drop the steps of VRF-aware NAT configuration for path isolation into the correct order, from first to last.

Which type of NAT translates multiple inside addresses to a single outside address using different port numbers?