hardMultiple SelectObjective-mapped
300-410 Practice Question: An engineer must configure NAT so that inside…
An engineer must configure NAT so that inside hosts (192.168.1.0/24) are translated to a public IP pool (203.0.113.1-203.0.113.10) when accessing the Internet, but must NOT translate traffic destined to a VPN subnet (10.10.10.0/24) reachable via the same outside interface. Which TWO configuration steps are required? (Choose TWO.)
⚠ Common exam trap
Cisco often tests the misconception that an ACL in 'ip nat inside source list' can filter by destination, when in fact it only matches source addresses, so candidates may incorrectly choose Option B without realizing it would translate VPN-bound traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an ACL that denies 10.10.10.0 0.0.0.255 and permits any, then reference it in a route map with 'match ip address'.
It creates an ACL that denies the VPN subnet (10.10.10.0/24) and permits all other traffic, which is then referenced in a route map. This route map is used with 'ip nat inside source route-map RMAP pool POOL' to ensure that traffic destined to the VPN subnet is NOT translated, while all other traffic (including Internet-bound traffic) is translated using the public IP pool. This approach leverages route-map matching to selectively bypass NAT for specific destinations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an ACL that denies 10.10.10.0 0.0.0.255 and permits any, then reference it in a route map with 'match ip address'.
Why this is correct
Correct. The ACL denies the VPN subnet, so the route map will not match traffic to that destination, thus exempting it from NAT.
- ✗
Apply 'ip nat inside source list 1 interface GigabitEthernet0/0 overload' where ACL 1 permits 192.168.1.0 0.0.0.255.
Why it's wrong here
Incorrect. This would translate all traffic from 192.168.1.0/24, including traffic to the VPN subnet, which is not desired.
- ✓
Use 'ip nat inside source route-map RMAP pool POOL' where the route map matches the ACL from step A.
Why this is correct
Correct. The route map uses the ACL to selectively translate only traffic not denied (i.e., not destined to VPN).
- ✗
Configure 'ip nat inside source static 192.168.1.1 203.0.113.1' for each host to ensure translation.
Why it's wrong here
Incorrect. Static NAT would require individual entries and would still translate traffic to the VPN subnet unless additional filtering is applied.
- ✗
Apply 'ip access-group 100 in' on the inside interface to block traffic to the VPN subnet.
Why it's wrong here
Incorrect. Blocking traffic is not the goal; the goal is to allow traffic but not translate it.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.