mediumMultiple Choice
300-410 Practice Question: Consider this partial configuration: ip nat…
Consider this partial configuration:
ip nat inside source list 1 interface GigabitEthernet0/1 overload access-list 1 permit 192.168.1.0 0.0.0.255
!
interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside
!
interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.0 ip nat outside
!
interface GigabitEthernet0/2 ip address 172.16.0.1 255.255.255.0 ip nat inside
What is true about traffic from the 172.16.0.0/24 network?
⚠ Common exam trap
Cisco often tests the misconception that all traffic on an interface marked 'ip nat inside' is automatically translated, but in reality, translation only occurs for traffic that matches the access-list referenced in the NAT command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It is not translated and will be forwarded with its original source IP.
The NAT configuration uses an access-list (list 1) that only matches traffic from the 192.168.1.0/24 network. Traffic sourced from the 172.16.0.0/24 network does not match this access-list, so it is not subject to NAT translation. As a result, the router forwards packets from 172.16.0.0/24 with their original source IP address unchanged.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It is translated using PAT to 203.0.113.1.
Why it's wrong here
Access list 1 permits only 192.168.1.0/24, so 172.16.0.0/24 traffic is not matched and therefore is not translated by this NAT rule. It would be translated only if the ACL also permitted 172.16.0.0 0.0.0.255. PAT to 203.0.113.1 applies solely to the permitted source subnet.
- ✓
It is not translated and will be forwarded with its original source IP.
Why this is correct
Access-list 1 permits only 192.168.1.0/24, so 172.16.0.0/24 traffic fails the match and bypasses NAT translation entirely. Because GigabitEthernet0/2 is marked ip nat inside but no corresponding permit statement exists, packets retain their original 172.16.0.x source address when routed out GigabitEthernet0/1.
- ✗
It is dropped because NAT is required for all inside interfaces.
Why it's wrong here
NAT is not mandatory on inside interfaces; the ip nat inside command only marks where translation may occur. Because access-list 1 permits solely 192.168.1.0/24, 172.16.0.0/24 traffic simply bypasses translation and is routed normally, not dropped. Dropping would require an explicit deny or route-map.
- ✗
It is translated using a different pool because it is on a separate inside interface.
Why it's wrong here
No separate pool exists; the single ip nat inside source statement references access-list 1, which permits only 192.168.1.0/24. Traffic from 172.16.0.0/24 matches no NAT rule and is forwarded untranslated. Defining per-interface pools would be the design when distinct inside networks genuinely require separate translation addresses.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.