mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Which TCP flag combination triggers the NAT…
Which TCP flag combination triggers the NAT translation timeout to change from the default to the 'ip nat translation tcp-timeout' value?
⚠ Common exam trap
Cisco often tests the misconception that any TCP flag (like SYN or ACK) can trigger the shorter timeout, but only FIN or RST explicitly signal connection termination and thus change the NAT timeout to the configured tcp-timeout value.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FIN or RST
By default, NAT translations for TCP sessions use a timeout based on the TCP connection's state. When a TCP session ends with a FIN or RST flag, the NAT device immediately transitions the translation to a 'finish' or 'reset' state, which then uses the value configured under 'ip nat translation tcp-timeout' (default 60 seconds) instead of the longer default idle timeout (typically 86400 seconds). This allows the NAT table to reclaim resources quickly after a connection is explicitly terminated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SYN
Why it's wrong here
SYN starts a connection; it does not trigger the shorter timeout.
- ✓
FIN or RST
Why this is correct
FIN and RST indicate connection termination, causing the NAT entry to expire quickly.
- ✗
ACK
Why it's wrong here
ACK is part of normal data transfer and does not trigger the shorter timeout.
- ✗
URG
Why it's wrong here
URG is urgent data and does not affect NAT timeout.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.