How many NAT and PAT Configuration Scenarios questions are on this page?

This page has 13 NAT and PAT Configuration Scenarios scenario questions for the 300-410 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 300-410 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CCNP ENARSI 300-410 questions

Scenario-based practice

NAT and PAT Configuration Scenarios

Practise 300-410 NAT and PAT questions covering address translation types, inside/outside interface roles, static vs dynamic vs PAT, and troubleshooting missing or incorrect translations.

Start full practice test Read exam guide

scenario questions

300-410

exam code

Cisco

vendor

Scenario guide

How to approach nat and pat configuration scenarios

NAT and PAT questions cover static NAT (one-to-one), dynamic NAT (pool-based), and PAT/overload (many-to-one using port numbers). The CCNA asks you to read NAT table output, fix misconfigured NAT, and match the right NAT type to a scenario.

Quick answer

NAT questions usually test how private addresses are translated, when to use static NAT, dynamic NAT or PAT, and how inside/outside interfaces affect traffic flow.

Static NAT, dynamic NAT and PAT behaviour.

Inside local, inside global, outside local and outside global address meanings.

How NAT affects connectivity between private networks and public destinations.

How to troubleshoot NAT rules, ACL matches and interface direction.

Practice scenarios

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

Consider the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside

interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside

ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect of this configuration?

A
All traffic from 192.168.1.0/24 is translated to 203.0.113.1 using PAT.
The 'overload' keyword enables PAT, and the ACL matches the inside network.
B
Only traffic from 192.168.1.1 is translated to 203.0.113.1 using PAT.
Why wrong: The ACL permits the entire /24 subnet, not just the router's interface IP.
C
Traffic is translated using static NAT to 203.0.113.1.
Why wrong: The command uses 'ip nat inside source list' which is dynamic NAT, not static.
D
The configuration is incomplete; a NAT pool is required for dynamic translation.
Why wrong: When using an interface with overload, no pool is needed; the interface IP is used.

Full breakdown with real-world context →

Question 2hardmulti select

Read the full NAT/PAT explanation →

Which THREE statements about NAT and PAT behavior in Cisco IOS are true? (Choose THREE.)

A
PAT allows multiple inside hosts to share a single public IP address by using unique source port numbers.
Correct. PAT multiplexes many inside addresses to one outside address by differentiating TCP/UDP ports.
B
The NAT translation table for PAT includes the inside global IP and port, and the outside global IP and port.
Correct. The full entry includes inside local, inside global, outside local, and outside global addresses and ports.
C
The command 'ip nat inside source list 1 interface GigabitEthernet0/0 overload' enables PAT using the interface IP.
Correct. This is the standard command for PAT where the interface IP is used as the inside global address.
D
The 'ip nat inside source static' command automatically enables PAT when multiple inside hosts are configured.
Why wrong: Incorrect. Static NAT creates a one-to-one mapping and does not use PAT; each inside host requires a separate public IP.
E
The 'ip nat pool' command is required for all PAT configurations.
Why wrong: Incorrect. PAT can use a single interface IP without a pool; a pool is only needed when using a range of addresses.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full NAT/PAT explanation →

Given this partial configuration:

ip nat pool MYPOOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool MYPOOL
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect?

A
Inside hosts are translated to addresses in the pool using PAT.
Why wrong: No 'overload' keyword means no port multiplexing; it's one-to-one dynamic NAT.
B
Inside hosts are dynamically mapped to a pool address; if the pool is exhausted, new translations fail.
Without overload, each translation consumes one pool address; exhaustion blocks new flows.
C
The router uses the pool address as the source for all outbound traffic, regardless of ACL.
Why wrong: The ACL restricts which inside addresses are eligible for translation.
D
This configuration requires the 'ip nat outside' interface command to function.
Why wrong: While 'ip nat outside' is needed on the outside interface, the question asks about the effect of the given commands alone; the effect is dynamic NAT without overload.

Full breakdown with real-world context →

Question 4mediummultiple choice

Study the full ACL explanation →

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- ---

R1# show ip nat statistics

Total active translations: 1 (0 static, 1 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 0 Misses: 0 CEF Translated packets: 0, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source

[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240

refcount 1 map-id 1

[Id] ip nat inside source list ACL1 pool POOL1

refcount 1

Based on this output, what is the problem?

A
The NAT translation exists but no traffic is being translated (0 hits, 0 misses), indicating a possible idle translation or no matching traffic.
The translation is present but no packets have been processed. This could be a stale entry or lack of traffic.
B
The NAT pool is exhausted.
Why wrong: Only one address is used out of 16.
C
PAT is misconfigured.
Why wrong: PAT is not configured; this is basic NAT.
D
The inside and outside interfaces are reversed.
Why wrong: The statistics show correct interface assignment.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full NAT/PAT explanation →

What is the problem with this NAT configuration?

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside

interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0

ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

A
The ACL is too permissive; it should only permit specific hosts.
Why wrong: The ACL is correctly permitting the inside network.
B
The interface GigabitEthernet0/1 is missing the 'ip nat outside' command.
Without 'ip nat outside', the router does not know which interface is the outside for NAT.
C
The 'overload' keyword is unnecessary for this configuration.
Why wrong: Overload is needed for PAT, which is likely intended.
D
The inside interface should be GigabitEthernet0/1.
Why wrong: Inside/outside designations are correct; only the outside interface is missing the command.

Full breakdown with real-world context →

Question 6mediumdrag order

Read the full NAT/PAT explanation →

Drag and drop the steps to verify and validate NAT and PAT operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 7mediummulti select

Read the full NAT/PAT explanation →

Which TWO configuration steps are required to implement static NAT on a Cisco IOS router? (Choose TWO.)

A
Configure ip nat inside source static <inside-local> <inside-global> in global configuration mode.
This command creates a permanent mapping between a private inside address and a public global address.
B
Apply the ip nat inside command on the interface facing the internal network.
This marks the interface as the inside NAT interface, enabling translation for traffic sourced from or destined to that interface.
C
Apply the ip nat outside command on the interface facing the internal network.
Why wrong: The outside command should be applied to the interface facing the external network, not the internal one.
D
Configure an access list to match the inside local addresses for translation.
Why wrong: Access lists are used for dynamic NAT or PAT, not for static NAT, which uses an explicit mapping.
E
Enable the ip nat service command globally to activate NAT.
Why wrong: There is no such global command; NAT is enabled by configuring translations and interface markings.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full VPN explanation →

A network engineer is troubleshooting NAT for a VPN tunnel. The router has a static NAT rule 'ip nat inside source static 10.0.0.10 203.0.113.10' for a server. The VPN traffic from the remote site to 203.0.113.10 is being NATed to 10.0.0.10, but the return traffic from the server to the remote site is not being translated back. The engineer sees that the server sends packets with source 10.0.0.10 to the remote site's public IP. What should the engineer do to fix this?

A
Add an 'ip nat outside' command on the inside interface.
Why wrong: Incorrect because the inside interface should be 'ip nat inside'; adding outside would break the NAT logic.
B
Configure a route-map to exempt the VPN traffic from NAT.
Why wrong: Incorrect because the issue is that NAT is not translating the outbound traffic; exempting would make it worse.
C
Ensure that the router has a route to the remote site's public IP via the outside interface, and that the static NAT entry is correctly applied.
Correct because if the return traffic from the server is routed out a different interface (e.g., a VPN tunnel interface), the NAT might not be applied; the router needs to route the traffic via the outside interface where NAT is configured.
D
Change the static NAT to 'ip nat inside source static 10.0.0.10 203.0.113.10 extendable'.
Why wrong: Incorrect because 'extendable' allows multiple static NATs for the same inside host, but it does not fix the routing/interface issue.

Full breakdown with real-world context →

Question 9mediummultiple choice

Study the full ACL explanation →

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- ---

R1# show ip nat statistics

Total active translations: 2 (0 static, 2 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 0 Misses: 10 CEF Translated packets: 0, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source

[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240

refcount 2 map-id 1

[Id] ip nat inside source list ACL1 pool POOL1

refcount 2

Based on this output, what is the problem?

A
NAT translations exist but no packets are being translated (0 hits), indicating a possible routing or ACL issue.
The 0 hits with 10 misses suggest that translations are created but no successful data flow; packets are missing or not returning.
B
The NAT pool is exhausted.
Why wrong: Only 2 translations exist out of 16 addresses.
C
PAT is enabled but not working.
Why wrong: The mapping does not include 'overload', so PAT is not configured.
D
The inside and outside interfaces are reversed.
Why wrong: The statistics show correct interface assignment.

Full breakdown with real-world context →

Question 10mediummultiple choice

Study the full ACL explanation →

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 203.0.113.5 203.0.113.5 --- 192.0.2.11 10.0.0.11 203.0.113.5 203.0.113.5

R1# show ip nat statistics

Total active translations: 2 (0 static, 2 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 20 Misses: 0 CEF Translated packets: 20, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source

[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240

refcount 2 map-id 1

[Id] ip nat inside source list ACL1 pool POOL1

refcount 2

Based on this output, which statement is correct?

A
NAT is configured without PAT; each inside host uses a unique global address.
The statistics show 0 extended translations, and the mapping lacks 'overload'. The translations show different inside global addresses for each inside local.
B
PAT is enabled, but only two translations are active.
Why wrong: PAT would show extended translations (protocol/port) and the 'overload' keyword in the mapping.
C
The pool is exhausted because two addresses are used.
Why wrong: The pool has 16 addresses; using 2 is not exhaustion.
D
Static NAT is configured for both hosts.
Why wrong: The statistics show 0 static translations.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full NAT/PAT explanation →

A network engineer runs the following command to troubleshoot a NAT issue:

R1# debug ip nat detailed

NAT: s=10.1.1.1->10.2.2.2, d=192.168.1.1 [45] NAT: s=10.1.1.1->10.2.2.2, d=192.168.1.1 [46] NAT: s=10.1.1.1->10.2.2.2, d=192.168.1.1 [47] NAT*: s=192.168.1.1, d=10.2.2.2->10.1.1.1 [48] NAT: s=10.1.1.1->10.2.2.2, d=192.168.1.1 [49]

What does this output indicate?

A
NAT is working correctly; the asterisk indicates a packet that was translated and fast-switched.
The asterisk shows fast-switching, and translations are occurring bidirectionally.
B
NAT is failing; the asterisk indicates a packet that was dropped.
Why wrong: The asterisk does not indicate a drop; it indicates fast-switching.
C
NAT is working but only for outbound traffic; return traffic is not being translated.
Why wrong: Return traffic is being translated, as seen in line 4.
D
NAT is not configured; the output shows only routing information.
Why wrong: The output clearly shows NAT translations.

Full breakdown with real-world context →

Question 12mediumdrag order

Read the full NAT/PAT explanation →

Drag and drop the steps to configure PAT (overload) for dynamic source NAT into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 13hardmultiple choice

Read the full NAT/PAT explanation →

According to RFC 4787 (NAT Behavioral Requirements for UDP), what is the recommended default timeout for UDP NAT mappings?

A
60 seconds
Why wrong: This is too short for general UDP traffic; RFC 4787 recommends 5 minutes.
B
300 seconds
Correct. RFC 4787 recommends and Cisco IOS defaults to 300 seconds for UDP NAT mappings.
C
600 seconds
Why wrong: This is not the recommended default; 300 seconds is the standard.
D
86400 seconds
Why wrong: This is the default for basic NAT, not UDP mappings.

Full breakdown with real-world context →

These 300-410 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 300-410 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

NAT and PAT Configuration Scenarios

How to approach nat and pat configuration scenarios

Quick answer

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

VPN Technologies practice questions

Infrastructure Security practice questions

Infrastructure Services practice questions

300-410 fundamentals practice questions

300-410 scenario practice questions

300-410 troubleshooting practice questions

Practice scenarios

Which THREE statements about NAT and PAT behavior in Cisco IOS are true? (Choose THREE.)

Drag and drop the steps to verify and validate NAT and PAT operational state into the correct order, from first to last.

Which TWO configuration steps are required to implement static NAT on a Cisco IOS router? (Choose TWO.)

Drag and drop the steps to configure PAT (overload) for dynamic source NAT into the correct order, from first to last.

According to RFC 4787 (NAT Behavioral Requirements for UDP), what is the recommended default timeout for UDP NAT mappings?