hardMultiple Select
300-410 Practice Question: Which THREE symptoms indicate that NAT is…
Which THREE symptoms indicate that NAT is misconfigured or failing on a Cisco router? (Choose THREE.)
⚠ Common exam trap
Cisco often tests the distinction between connectivity to the outside interface (which does not require NAT) and connectivity beyond it (which requires proper NAT translation), leading candidates to mistakenly think that successful pings to the outside interface imply full NAT functionality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inside hosts can ping the outside interface IP but cannot reach hosts beyond it.
Option A is correct because when inside hosts can ping the outside interface IP but cannot reach hosts beyond it, the router's interface is reachable but address translation is not occurring, so packets sourced from inside local addresses are not being translated to an inside global address and are dropped or unroutable on the outside. Option B is correct because NAT failures commonly produce asymmetric behavior: outbound packets may be translated and forwarded, but if the translation entry is missing, incorrect, or the return traffic cannot be mapped back to the inside local address, the reply is dropped, so only one direction of the flow succeeds. Option C is correct because seeing many translations sharing the same inside global address with different ports indicates PAT overload, and if new connections fail, the router has likely exhausted the available port range or the translation table, which is a classic NAT/PAT misconfiguration or capacity failure symptom. Option D is not correct because high CPU from the BGP process is a routing protocol issue, not a direct NAT misconfiguration or failure symptom. Option E is not correct because a default route pointing to the ISP next hop is a normal, expected routing configuration and does not by itself indicate NAT is misconfigured or failing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Inside hosts can ping the outside interface IP but cannot reach hosts beyond it.
Why this is correct
Reaching the outside interface proves routing and NAT translation of the router's own traffic work, yet failure beyond it points to missing or incorrect inside source translation for host traffic, or an upstream return-path problem.
- ✓
Traffic flows in one direction only (e.g., inside-to-outside works, but return traffic fails).
Why this is correct
Asymmetric flow indicates the translation entry or return route is missing, so replies cannot be mapped back to the inside local address. NAT relies on bidirectional state, and one-way traffic confirms that state is broken.
- ✓
The show ip nat translations output shows many translations with the same inside global address but different ports, and new connections fail.
Why this is correct
Port overload (PAT) exhaustion is the mechanism: many inside local addresses share one inside global address, differentiated only by port, so once the available port range is consumed, new connections cannot be allocated a translation and fail. This directly satisfies the stem's requirement for a NAT failure symptom.
- ✗
The router's CPU utilization is high due to BGP process.
Why it's wrong here
High CPU from the BGP process reflects routing-table churn or peering issues, unrelated to NAT translation state. It is tempting because NAT does consume CPU, and checking BGP CPU would be correct when diagnosing route flapping or neighbour resets rather than translation failures.
- ✗
The show ip route command shows a default route pointing to the ISP next hop.
Why it's wrong here
A default route pointing to the ISP is normal, expected configuration on a NAT edge router, so it indicates nothing about NAT failure. It is tempting because missing or wrong default routes do break NAT, and verifying that route would be correct when troubleshooting outbound connectivity loss.
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.