mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures NAT overload on a router
An engineer configures NAT overload on a router. The inside network uses 172.16.0.0/16, and the outside interface is 198.51.100.1. The engineer uses 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. ACL 1 permits 172.16.0.0 0.0.255.255. Traffic works, but the engineer notices that the router's CPU utilization is high, and 'show ip nat translations' shows thousands of entries. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the misconception that high CPU and many NAT entries are always due to an attack or ACL misconfiguration, when the real issue is often the NAT translation timeout being too high, causing stale entries to accumulate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT translation timeout is set too high, causing old entries to remain.
The high CPU utilization and thousands of NAT translations indicate that the router is maintaining an excessive number of translation entries. The default NAT timeout for TCP is 86400 seconds (24 hours) and for UDP is 300 seconds. If the timeout is set too high, old entries are not cleared promptly, causing the translation table to grow large and consuming CPU resources for lookups and maintenance. This is the most likely cause given the symptoms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The router is under a DDoS attack generating many NAT translations.
Why it's wrong here
Incorrect while possible, it is not the most likely cause; the engineer should first check NAT timeouts.
- ✓
The NAT translation timeout is set too high, causing old entries to remain.
Why this is correct
Correct because if the timeout (e.g., 'ip nat translation timeout') is high, entries for short-lived flows (like DNS) stay longer, accumulating and consuming CPU.
- ✗
The ACL is too permissive, allowing traffic from outside to initiate NAT.
Why it's wrong here
Incorrect because ACL 1 is used for inside source NAT; it does not affect outside-initiated traffic.
- ✗
The outside interface is using a different IP than configured.
Why it's wrong here
Incorrect because if the IP were wrong, NAT would fail entirely; the issue is performance, not connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.