hardMultiple SelectObjective-mapped
300-410 Practice Question: An engineer is troubleshooting a PAT overload…
An engineer is troubleshooting a PAT overload configuration on a Cisco router. Inside hosts can access the Internet, but some applications (e.g., FTP, SIP) fail. Which TWO commands can be used to verify the NAT translations and identify the issue? (Choose TWO.)
⚠ Common exam trap
Cisco often tests the distinction between commands that show configuration versus commands that show operational state; the trap here is that candidates may pick 'show running-config | include nat' thinking it reveals translation issues, but it only shows static configuration, not dynamic translations or real-time failures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
'show ip nat translations'
The 'show ip nat translations' command displays the current NAT translation table, including inside local, inside global, outside local, and outside global addresses. This allows the engineer to verify whether translations are being created correctly for protocols like FTP and SIP, which may fail due to missing or incorrect translations, especially when PAT overload is used and application-layer gateways (ALGs) are not handling embedded IP addresses or ports properly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
'show ip nat translations'
Why this is correct
Correct. This shows the current NAT table, including inside local, inside global, outside local, and outside global addresses and ports.
- ✓
'debug ip nat detailed'
Why this is correct
Correct. This debug provides detailed information about each packet being translated, including application-layer changes.
- ✗
'show ip nat statistics'
Why it's wrong here
Incorrect. This shows hit counts and configuration summary, not per-translation details needed for application failure analysis.
- ✗
'show ip access-lists'
Why it's wrong here
Incorrect. This shows ACL entries and matches, not NAT translations.
- ✗
'show running-config | include nat'
Why it's wrong here
Incorrect. This shows the NAT configuration, not the operational translations or debug output.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.