How many NAT and PAT Configuration Scenarios questions are on this page?

This page has 7 NAT and PAT Configuration Scenarios scenario questions for the 350-701 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-701 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco SCOR / CCNP Security Core 350-701 questions

Scenario-based practice

NAT and PAT Configuration Scenarios

Practise 350-701 NAT and PAT questions covering address translation types, inside/outside interface roles, static vs dynamic vs PAT, and troubleshooting missing or incorrect translations.

Start full practice test Read exam guide

scenario questions

350-701

exam code

Cisco

vendor

Scenario guide

How to approach nat and pat configuration scenarios

NAT and PAT questions cover static NAT (one-to-one), dynamic NAT (pool-based), and PAT/overload (many-to-one using port numbers). The CCNA asks you to read NAT table output, fix misconfigured NAT, and match the right NAT type to a scenario.

Quick answer

NAT questions usually test how private addresses are translated, when to use static NAT, dynamic NAT or PAT, and how inside/outside interfaces affect traffic flow.

Static NAT, dynamic NAT and PAT behaviour.

Inside local, inside global, outside local and outside global address meanings.

How NAT affects connectivity between private networks and public destinations.

How to troubleshoot NAT rules, ACL matches and interface direction.

Practice scenarios

Question 1easymultiple choice

Read the full NAT/PAT explanation →

Refer to the exhibit. What is the effect of this NAT rule on the Cisco FTD device deployed in the cloud?

Exhibit

Refer to the exhibit.

ciscoftd(config)# show running-config | section nat
nat (inside,outside) source static 10.0.1.0 10.0.1.0 destination static 192.168.1.0 192.168.1.0 no-proxy-arp route-lookup

A
Performs identity NAT between the two networks without port translation
The 'static' keyword with same IP on both sides indicates identity NAT.
B
Translates source IP when traffic goes from outside to inside
Why wrong: The rule is applied on the 'inside' interface; source translation is static for inside to outside traffic.
C
Enables Port Address Translation (PAT)
Why wrong: There is no 'pat' keyword; this is identity NAT.
D
Translates destination IP from 192.168.1.0 to a public IP
Why wrong: Destination is also static with same IP, so no translation.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full NAT/PAT explanation →

Refer to the exhibit. An ASA is configured with the above access-list and NAT rule. A web server is reachable from the internet via the public IP 203.0.113.10. However, internal users from the inside network cannot access the web server using its public IP address. What is the most likely cause?

Exhibit

configure terminal
access-list OUTSIDE extended permit tcp any host 203.0.113.10 eq www
access-list OUTSIDE extended permit udp any host 203.0.113.10 eq domain
nat (inside,outside) source dynamic any interface

A
The NAT rule is missing a static NAT for the server.
Without a static NAT, internal users cannot access the server via the public IP due to lack of hairpinning.
B
The access-list does not permit traffic from inside to outside for that destination.
Why wrong: The ACL is applied on the outside interface, so it does not filter inside-to-outside traffic.
C
The interface ACL is applied inbound on the inside interface.
Why wrong: The ACL is applied to the outside interface, not inside.
D
The default route is missing.
Why wrong: A missing default route would affect traffic to the internet, but not specifically internal access to a public IP.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full NAT/PAT explanation →

A Cisco ASA is configured with dynamic PAT to translate internal addresses to a single outside IP address. A user on the inside initiates a connection to an external web server. The ASA creates a connection entry. Which table is checked first when a return packet arrives from the web server?

A
ACL table
Why wrong: ACLs are checked for new connections, not for established ones.
B
Connection table (conn)
Correct. The ASA checks the connection table to see if the packet belongs to an existing session.
C
NAT table (xlate)
Why wrong: The xlate table is used for NAT, but the connection table is checked first for state.
D
Routing table
Why wrong: Routing is checked after connection lookup.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full NAT/PAT explanation →

Which NAT type on a Cisco ASA translates both the source and destination IP addresses and is typically used to allow external hosts to access internal servers?

A
Identity NAT
Why wrong: Incorrect. Identity NAT bypasses translation but does not translate addresses.
B
PAT (Port Address Translation)
Why wrong: Incorrect. PAT translates source IP and port, not destination.
C
Static NAT
Correct. Static NAT provides a fixed mapping for both directions.
D
Dynamic NAT
Why wrong: Incorrect. Dynamic NAT translates only source IP addresses from a pool, not destination.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full NAT/PAT explanation →

On a Cisco ASA, which NAT type allows multiple internal hosts to share a single public IP address by using different source ports?

A
PAT (overload)
Correct. PAT uses port numbers to multiplex multiple internal hosts to a single public IP.
B
Identity NAT
Why wrong: Identity NAT bypasses translation, does not share IPs.
C
Static NAT
Why wrong: Static NAT provides one-to-one mapping, not sharing.
D
Dynamic NAT
Why wrong: Dynamic NAT uses a pool of public IPs, but does not overload ports.

Full breakdown with real-world context →

Question 6mediummultiple choice

Study the full ACL explanation →

A Cisco ASA has three interfaces: inside (100), outside (0), and DMZ (50). A static NAT rule is configured to map the DMZ server 10.1.1.10 to outside address 200.1.1.10. An ACL on the outside interface permits traffic to 200.1.1.10. A host on the internet sends a packet to 200.1.1.10. What happens when the packet hits the outside interface?

A
The packet is dropped because no ACL exists for the DMZ interface.
Why wrong: No ACL is needed on DMZ for this traffic; the outside ACL permits it.
B
The packet is forwarded only if an ACL on the DMZ interface permits it.
Why wrong: The ACL on the outside interface is sufficient; the DMZ interface does not require an inbound ACL for this traffic.
C
The packet is forwarded to the DMZ server after NAT translation.
Correct. Static NAT translates the destination to the DMZ IP and forwards the packet.
D
The packet is dropped because the outside security level is lower than DMZ.
Why wrong: NAT bypasses the security level check for inbound traffic.

Full breakdown with real-world context →

Question 7mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is troubleshooting an issue where users on VLAN 10 cannot access the internet, but they can reach internal resources. The firewall is configured with a default route pointing to the ISP router. The engineer notices that NAT is configured but traffic is not being translated. Which configuration is most likely missing?

A
An ACL to match the traffic to be translated
The ACL defines interesting traffic for NAT; without it, no packets are matched for translation.
B
A NAT pool with available public IP addresses
Why wrong: A NAT pool is needed for dynamic NAT, but the immediate issue is the missing ACL to match traffic.
C
Port Address Translation (PAT) configuration
Why wrong: PAT is a type of NAT, but the missing element is the ACL to identify traffic for translation.
D
A route map to apply NAT based on destination
Why wrong: Route maps are optional for policy-based NAT; standard NAT requires an ACL first.

Full breakdown with real-world context →

These 350-701 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-701 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

NAT and PAT Configuration Scenarios

How to approach nat and pat configuration scenarios

Quick answer

Related 350-701 topic practice pages

Security Concepts practice questions

Network Security practice questions

Cloud Security practice questions

Content Security practice questions

Endpoint Protection and Detection practice questions

Secure Network Access, Visibility and Enforcement practice questions

350-701 fundamentals practice questions

350-701 scenario practice questions

350-701 troubleshooting practice questions

Practice scenarios

Refer to the exhibit. What is the effect of this NAT rule on the Cisco FTD device deployed in the cloud?

Exhibit

Refer to the exhibit. An ASA is configured with the above access-list and NAT rule. A web server is reachable from the internet via the public IP 203.0.113.10. However, internal users from the inside network cannot access the web server using its public IP address. What is the most likely cause?

Exhibit

A Cisco ASA is configured with dynamic PAT to translate internal addresses to a single outside IP address. A user on the inside initiates a connection to an external web server. The ASA creates a connection entry. Which table is checked first when a return packet arrives from the web server?

Which NAT type on a Cisco ASA translates both the source and destination IP addresses and is typically used to allow external hosts to access internal servers?

On a Cisco ASA, which NAT type allows multiple internal hosts to share a single public IP address by using different source ports?