NAT and PAT practice questions

A network engineer is troubleshooting connectivity from a host inside a corporate network to a public web server. The host has IP 10.1.1.10/24, and the router's outside interface is 203.0.113.1/24. The engineer configured a dynamic NAT pool (203.0.113.10-203.0.113.20) and an access list permitting 10.1.1.0/24. However, traffic from the host fails. A 'show ip nat translations' reveals no translations. What is the most likely cause?

Trap 1: The NAT pool is exhausted.

Incorrect because the pool has 11 addresses, and only one host is trying to translate; no translations appear at all, not a pool exhaustion issue.

Trap 2: The 'ip nat inside' and 'ip nat outside' commands are misapplied on…

Incorrect because if the interfaces are not correctly designated, translations might still appear but traffic would not flow; however, no translations at all suggests the ACL is the issue.

Trap 3: The host's default gateway is not the router's inside interface.

Incorrect because even if the gateway is wrong, the router would still see the traffic and attempt NAT if the ACL matches; no translations indicate a different issue.

A
The NAT pool is exhausted.
Why wrong: Incorrect because the pool has 11 addresses, and only one host is trying to translate; no translations appear at all, not a pool exhaustion issue.
B
The 'ip nat inside' and 'ip nat outside' commands are misapplied on the interfaces.
Why wrong: Incorrect because if the interfaces are not correctly designated, translations might still appear but traffic would not flow; however, no translations at all suggests the ACL is the issue.
C
The access list used in the NAT configuration does not match the source IP of the host.
Correct because dynamic NAT requires the ACL to match the source; if the ACL is misconfigured (e.g., denies the subnet), no translations are created.
D
The host's default gateway is not the router's inside interface.
Why wrong: Incorrect because even if the gateway is wrong, the router would still see the traffic and attempt NAT if the ACL matches; no translations indicate a different issue.

Question 2mediummultiple choice

A network engineer is troubleshooting PAT (overload) on a Cisco router. The inside network uses 192.168.1.0/24, and the outside interface has IP 198.51.100.1. The engineer configured 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. Traffic from inside hosts works initially, but after a few minutes, new connections fail. 'Show ip nat translations' shows many entries with the same outside global IP but different ports. 'Show ip nat statistics' indicates that the number of translations is near 500. What is the most likely cause?

Trap 1: The NAT pool is not configured with overload.

Incorrect because overload is configured, as seen by the many translations sharing the same IP.

Trap 2: The outside interface is flapping, causing translations to be…

Incorrect because if the interface flapped, translations would be cleared, not accumulated.

Trap 3: The access list is denying some inside hosts.

Incorrect because if the ACL were denying hosts, those hosts would never get translations; the issue is that translations exist but new ones fail.

A
The NAT pool is not configured with overload.
Why wrong: Incorrect because overload is configured, as seen by the many translations sharing the same IP.
B
The outside interface is flapping, causing translations to be cleared.
Why wrong: Incorrect because if the interface flapped, translations would be cleared, not accumulated.
C
The router has run out of available port numbers for PAT.
Correct because PAT uses a limited port range (usually 1024-65535), and with many sessions, ports can be exhausted, preventing new translations.
D
The access list is denying some inside hosts.
Why wrong: Incorrect because if the ACL were denying hosts, those hosts would never get translations; the issue is that translations exist but new ones fail.

Question 3hardmultiple choice

An engineer configures static NAT on a router to map a public IP 203.0.113.5 to an internal server 10.0.0.5. The configuration includes 'ip nat inside source static 10.0.0.5 203.0.113.5'. The server is reachable from the outside, but the server cannot initiate connections to the outside network. 'Show ip nat translations' shows the static entry. What is the most likely cause?

Trap 1: The server's default gateway is not the router's inside interface.

Incorrect because if the gateway were wrong, the server would not send traffic to the router at all; the issue is that traffic reaches the router but is not translated.

Trap 2: The 'ip nat outside' command is missing on the outside interface.

Incorrect because the static entry is for inbound traffic; outbound traffic from the server would need a separate NAT rule (like PAT) to translate the source.

Trap 3: The router's routing table does not have a route back to the…

Incorrect because the server is directly connected, so the router has a connected route; the issue is translation, not routing.

A
The server's default gateway is not the router's inside interface.
Why wrong: Incorrect because if the gateway were wrong, the server would not send traffic to the router at all; the issue is that traffic reaches the router but is not translated.
B
The 'ip nat outside' command is missing on the outside interface.
Why wrong: Incorrect because the static entry is for inbound traffic; outbound traffic from the server would need a separate NAT rule (like PAT) to translate the source.
C
Static NAT does not translate the source IP for outbound traffic initiated by the inside host.
Correct because static NAT only translates destination IP for inbound traffic; for outbound, the source remains private unless additional NAT (e.g., overload) is configured for that host.
D
The router's routing table does not have a route back to the server's subnet.
Why wrong: Incorrect because the server is directly connected, so the router has a connected route; the issue is translation, not routing.

Question 4hardmultiple choice

A network engineer is troubleshooting NAT for a VoIP phone that uses SIP. The phone is at 192.168.2.10, and the router performs PAT to the outside interface 198.51.100.1. The phone can register with the SIP server, but calls fail after 30 seconds. The engineer notices that the SIP signaling includes the phone's private IP in the SDP body. What is the most likely cause?

Trap 1: The PAT port range is exhausted.

Incorrect because calls fail after 30 seconds, not immediately; port exhaustion would prevent new calls, not drop established ones.

Trap 2: The phone's default gateway is misconfigured.

Incorrect because the phone can register, so it can reach the server; the issue is with media path, not initial connectivity.

Trap 3: The outside interface has a firewall blocking UDP ports.

Incorrect because if a firewall were blocking, the call would not even establish; the issue is specific to NAT and SIP payload.

A
The PAT port range is exhausted.
Why wrong: Incorrect because calls fail after 30 seconds, not immediately; port exhaustion would prevent new calls, not drop established ones.
B
The router's SIP ALG is disabled, so the private IP in the SDP is not translated.
Correct because without SIP ALG, the router does not inspect and translate the IP addresses inside the SIP messages, causing media to be sent to the private IP.
C
The phone's default gateway is misconfigured.
Why wrong: Incorrect because the phone can register, so it can reach the server; the issue is with media path, not initial connectivity.
D
The outside interface has a firewall blocking UDP ports.
Why wrong: Incorrect because if a firewall were blocking, the call would not even establish; the issue is specific to NAT and SIP payload.

Question 5mediummultiple choice

An engineer configures NAT on a router with 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. The inside hosts are 10.0.0.0/24, and the outside interface is 203.0.113.1. Traffic works for most hosts, but one host at 10.0.0.50 cannot access the internet. 'Show ip nat translations' shows no entry for this host. 'Show access-lists' shows ACL 1 permits 10.0.0.0 0.0.0.255. What is the most likely cause?

Trap 1: The host's IP address is statically assigned and conflicts with…

Incorrect because an IP conflict would cause intermittent issues, but the host would still send traffic; the router would see the traffic and attempt NAT.

Trap 2: The NAT pool is exhausted.

Incorrect because other hosts work, so ports are available; no translation for this host means its traffic never reaches the NAT process.

Trap 3: The router's inside interface is administratively down.

Incorrect because if the interface were down, no hosts would work; the issue is host-specific.

A
The host's IP address is statically assigned and conflicts with another device.
Why wrong: Incorrect because an IP conflict would cause intermittent issues, but the host would still send traffic; the router would see the traffic and attempt NAT.
B
The host has a misconfigured subnet mask or default gateway.
Correct because if the host's default gateway is not the router's inside interface (or subnet mask is wrong), the host will not send traffic to the router, so no NAT translation is attempted.
C
The NAT pool is exhausted.
Why wrong: Incorrect because other hosts work, so ports are available; no translation for this host means its traffic never reaches the NAT process.
D
The router's inside interface is administratively down.
Why wrong: Incorrect because if the interface were down, no hosts would work; the issue is host-specific.

Read the full VPN explanation →

Question 6hardmultiple choice

A network engineer is troubleshooting NAT for a VPN tunnel. The router has a static NAT rule 'ip nat inside source static 10.0.0.10 203.0.113.10' for a server. The VPN traffic from the remote site to 203.0.113.10 is being NATed to 10.0.0.10, but the return traffic from the server to the remote site is not being translated back. The engineer sees that the server sends packets with source 10.0.0.10 to the remote site's public IP. What should the engineer do to fix this?

Trap 1: Add an 'ip nat outside' command on the inside interface.

Incorrect because the inside interface should be 'ip nat inside'; adding outside would break the NAT logic.

Trap 2: Configure a route-map to exempt the VPN traffic from NAT.

Incorrect because the issue is that NAT is not translating the outbound traffic; exempting would make it worse.

Trap 3: Change the static NAT to 'ip nat inside source static 10.0.0.10…

Incorrect because 'extendable' allows multiple static NATs for the same inside host, but it does not fix the routing/interface issue.

A
Add an 'ip nat outside' command on the inside interface.
Why wrong: Incorrect because the inside interface should be 'ip nat inside'; adding outside would break the NAT logic.
B
Configure a route-map to exempt the VPN traffic from NAT.
Why wrong: Incorrect because the issue is that NAT is not translating the outbound traffic; exempting would make it worse.
C
Ensure that the router has a route to the remote site's public IP via the outside interface, and that the static NAT entry is correctly applied.
Correct because if the return traffic from the server is routed out a different interface (e.g., a VPN tunnel interface), the NAT might not be applied; the router needs to route the traffic via the outside interface where NAT is configured.
D
Change the static NAT to 'ip nat inside source static 10.0.0.10 203.0.113.10 extendable'.
Why wrong: Incorrect because 'extendable' allows multiple static NATs for the same inside host, but it does not fix the routing/interface issue.

Question 7mediummultiple choice

An engineer configures NAT overload on a router. The inside network uses 172.16.0.0/16, and the outside interface is 198.51.100.1. The engineer uses 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. ACL 1 permits 172.16.0.0 0.0.255.255. Traffic works, but the engineer notices that the router's CPU utilization is high, and 'show ip nat translations' shows thousands of entries. What is the most likely cause?

Trap 1: The router is under a DDoS attack generating many NAT translations.

Incorrect while possible, it is not the most likely cause; the engineer should first check NAT timeouts.

Trap 2: The ACL is too permissive, allowing traffic from outside to…

Incorrect because ACL 1 is used for inside source NAT; it does not affect outside-initiated traffic.

Trap 3: The outside interface is using a different IP than configured.

Incorrect because if the IP were wrong, NAT would fail entirely; the issue is performance, not connectivity.

A
The router is under a DDoS attack generating many NAT translations.
Why wrong: Incorrect while possible, it is not the most likely cause; the engineer should first check NAT timeouts.
B
The NAT translation timeout is set too high, causing old entries to remain.
Correct because if the timeout (e.g., 'ip nat translation timeout') is high, entries for short-lived flows (like DNS) stay longer, accumulating and consuming CPU.
C
The ACL is too permissive, allowing traffic from outside to initiate NAT.
Why wrong: Incorrect because ACL 1 is used for inside source NAT; it does not affect outside-initiated traffic.
D
The outside interface is using a different IP than configured.
Why wrong: Incorrect because if the IP were wrong, NAT would fail entirely; the issue is performance, not connectivity.

Question 8hardmultiple choice

A network engineer is troubleshooting NAT for a web server that is reachable from the internet via a static NAT mapping 203.0.113.20 to 10.0.0.20. The server responds to HTTP requests, but the engineer cannot SSH to the server from the internet. 'Show ip nat translations' shows the static entry. The router's ACL on the outside interface permits TCP port 22 to 203.0.113.20. What is the most likely cause?

Trap 1: The server's default gateway is not the router's inside interface.

Incorrect because if the gateway were wrong, HTTP would also fail; the issue is protocol-specific.

Trap 2: The SSH service is not running on the server.

Incorrect because the engineer can test with a different protocol; the issue is likely NAT-related.

Trap 3: The router's ACL is blocking SSH traffic despite the permit…

Incorrect because the ACL is configured to permit; if it were blocking, HTTP would also be affected if the ACL were misapplied.

A
The server's default gateway is not the router's inside interface.
Why wrong: Incorrect because if the gateway were wrong, HTTP would also fail; the issue is protocol-specific.
B
The router's NAT is not translating the return traffic for SSH because the server sends packets with a different source IP.
Correct because if the server has multiple IPs or a different source IP for SSH responses (e.g., from a loopback), the router may not translate that source IP back to 203.0.113.20, breaking the session.
C
The SSH service is not running on the server.
Why wrong: Incorrect because the engineer can test with a different protocol; the issue is likely NAT-related.
D
The router's ACL is blocking SSH traffic despite the permit statement.
Why wrong: Incorrect because the ACL is configured to permit; if it were blocking, HTTP would also be affected if the ACL were misapplied.

Question 9mediummultiple choice

An engineer configures NAT on a router with 'ip nat inside source list 1 pool POOL overload' where POOL contains 203.0.113.1-203.0.113.5. The inside hosts are 10.0.0.0/24. Traffic works, but the engineer notices that some hosts are assigned the same public IP and port, causing conflicts. 'Show ip nat translations' shows entries with the same inside global IP and port for different inside local hosts. What is the most likely cause?

Trap 1: The pool has only one IP address, and the router is reusing ports…

Incorrect because PAT should assign different ports even with one IP; reusing the same port for different hosts would cause conflicts and is not normal behavior.

Trap 2: The 'ip nat inside source' command is missing the 'overload'…

Incorrect because 'overload' is configured; the issue is not about missing overload.

Trap 3: The router is not performing PAT correctly because the ACL permits…

Incorrect because PAT should still assign unique ports; the issue is likely a bug or misconfiguration.

A
The pool has only one IP address, and the router is reusing ports for different hosts.
Why wrong: Incorrect because PAT should assign different ports even with one IP; reusing the same port for different hosts would cause conflicts and is not normal behavior.
B
The 'ip nat inside source' command is missing the 'overload' keyword.
Why wrong: Incorrect because 'overload' is configured; the issue is not about missing overload.
C
The router is not performing PAT correctly because the ACL permits more than the pool can handle.
Why wrong: Incorrect because PAT should still assign unique ports; the issue is likely a bug or misconfiguration.
D
The router has a configuration that uses 'ip nat inside source static' for some hosts, conflicting with the dynamic pool.
Correct because if a static NAT entry maps a host to the same public IP as the pool, and the static entry does not use port translation, it can cause conflicts with dynamic entries.

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- --- --- 192.0.2.12 10.0.0.12 --- ---

R1# show ip nat statistics

Total active translations: 3 (0 static, 3 dynamic; 3 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 45 Misses: 0 CEF Translated packets: 45, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source

[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240

refcount 3 map-id 1 overload

[Id] ip nat inside source list ACL1 pool POOL1 overload

refcount 3

Based on this output, which statement is correct?

Trap 1: NAT is failing because the pool is exhausted.

The pool has 16 addresses, and only 3 are used. Exhaustion is not indicated.

Trap 2: Static NAT is configured, but dynamic NAT is not working.

The statistics show 0 static translations and 3 dynamic. Static NAT is not configured.

Trap 3: The inside and outside interfaces are reversed.

The interfaces are correctly listed: GigabitEthernet0/0 as inside, GigabitEthernet0/1 as outside.

A
PAT is working correctly; translations are dynamic and overload is enabled.
The output shows dynamic mappings with overload, and translations are active. No errors or misses indicate proper operation.
B
NAT is failing because the pool is exhausted.
Why wrong: The pool has 16 addresses, and only 3 are used. Exhaustion is not indicated.
C
Static NAT is configured, but dynamic NAT is not working.
Why wrong: The statistics show 0 static translations and 3 dynamic. Static NAT is not configured.
D
The inside and outside interfaces are reversed.
Why wrong: The interfaces are correctly listed: GigabitEthernet0/0 as inside, GigabitEthernet0/1 as outside.

Question 11hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global udp 192.0.2.10:1234 10.0.0.10:1234 203.0.113.5:53 203.0.113.5:53 tcp 192.0.2.10:5678 10.0.0.10:5678 198.51.100.20:80 198.51.100.20:80 --- 192.0.2.11 10.0.0.11 --- ---

R1# show ip nat statistics

Total active translations: 3 (0 static, 3 dynamic; 3 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 100 Misses: 0 CEF Translated packets: 100, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source

[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240

refcount 3 map-id 1 overload

[Id] ip nat inside source list ACL1 pool POOL1 overload

refcount 3

Based on this output, what is the problem?

Trap 1: The pool is exhausted because 192.0.2.10 is used twice.

PAT allows multiple inside hosts to share the same global address; this is normal. Exhaustion would occur if all pool addresses were used without overload.

Trap 2: The outside interface is misconfigured as inside.

The statistics show correct interface assignment.

Trap 3: The NAT translations are all static.

The statistics clearly show 0 static translations.

A
The third translation is not using PAT, indicating a possible ACL or route-map misconfiguration.
The overload configuration should create PAT entries with protocol/port. The third entry without protocol suggests the traffic from 10.0.0.11 is not being matched by the same ACL or is using a different pool.
B
The pool is exhausted because 192.0.2.10 is used twice.
Why wrong: PAT allows multiple inside hosts to share the same global address; this is normal. Exhaustion would occur if all pool addresses were used without overload.
C
The outside interface is misconfigured as inside.
Why wrong: The statistics show correct interface assignment.
D
The NAT translations are all static.
Why wrong: The statistics clearly show 0 static translations.

Question 12mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 203.0.113.5 203.0.113.5 --- 192.0.2.11 10.0.0.11 203.0.113.5 203.0.113.5

R1# show ip nat statistics

Total active translations: 2 (0 static, 2 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 20 Misses: 0 CEF Translated packets: 20, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source

[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240

refcount 2 map-id 1

[Id] ip nat inside source list ACL1 pool POOL1

refcount 2

Based on this output, which statement is correct?

Trap 1: PAT is enabled, but only two translations are active.

PAT would show extended translations (protocol/port) and the 'overload' keyword in the mapping.

Trap 2: The pool is exhausted because two addresses are used.

The pool has 16 addresses; using 2 is not exhaustion.

Trap 3: Static NAT is configured for both hosts.

The statistics show 0 static translations.

A
NAT is configured without PAT; each inside host uses a unique global address.
The statistics show 0 extended translations, and the mapping lacks 'overload'. The translations show different inside global addresses for each inside local.
B
PAT is enabled, but only two translations are active.
Why wrong: PAT would show extended translations (protocol/port) and the 'overload' keyword in the mapping.
C
The pool is exhausted because two addresses are used.
Why wrong: The pool has 16 addresses; using 2 is not exhaustion.
D
Static NAT is configured for both hosts.
Why wrong: The statistics show 0 static translations.

Question 13easymultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- ---

R1# show ip nat statistics

Total active translations: 1 (1 static, 0 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 5 Misses: 0 CEF Translated packets: 5, CEF Punted packets: 0 Expired translations: 0

Based on this output, which statement is correct?

Trap 1: Dynamic NAT is configured with overload.

The statistics show 0 dynamic translations.

Trap 2: The NAT pool is exhausted.

No pool is used for static NAT.

Trap 3: PAT is translating multiple hosts to the same global address.

Only one translation exists, and it is static.

A
Static NAT is configured for host 10.0.0.10 to 192.0.2.10.
The translation shows a static mapping (no protocol, and statistics confirm static).
B
Dynamic NAT is configured with overload.
Why wrong: The statistics show 0 dynamic translations.
C
The NAT pool is exhausted.
Why wrong: No pool is used for static NAT.
D
PAT is translating multiple hosts to the same global address.
Why wrong: Only one translation exists, and it is static.

Question 14hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global tcp 192.0.2.10:80 10.0.0.10:80 203.0.113.5:12345 203.0.113.5:12345 tcp 192.0.2.10:80 10.0.0.11:80 203.0.113.5:67890 203.0.113.5:67890

R1# show ip nat statistics

Total active translations: 2 (0 static, 2 dynamic; 2 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 50 Misses: 0 CEF Translated packets: 50, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source

[Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload

refcount 2

Based on this output, what is the problem?

Trap 1: The NAT pool is misconfigured because it uses the interface address.

Using the interface address for PAT is valid.

Trap 2: The inside and outside interfaces are swapped.

The statistics show correct interface assignment.

Trap 3: Static NAT is interfering with dynamic NAT.

No static translations are present.

A
PAT is not assigning unique source ports; both translations use port 80, which will cause conflicts.
In PAT, the router should change the source port to a unique value. Both translations showing the same inside global port 80 indicates a problem.
B
The NAT pool is misconfigured because it uses the interface address.
Why wrong: Using the interface address for PAT is valid.
C
The inside and outside interfaces are swapped.
Why wrong: The statistics show correct interface assignment.
D
Static NAT is interfering with dynamic NAT.
Why wrong: No static translations are present.

Question 15mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- ---

R1# show ip nat statistics

Total active translations: 2 (0 static, 2 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 0 Misses: 10 CEF Translated packets: 0, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source

[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240

refcount 2 map-id 1

[Id] ip nat inside source list ACL1 pool POOL1

refcount 2

Based on this output, what is the problem?

Trap 1: The NAT pool is exhausted.

Only 2 translations exist out of 16 addresses.

Trap 2: PAT is enabled but not working.

The mapping does not include 'overload', so PAT is not configured.

Trap 3: The inside and outside interfaces are reversed.

The statistics show correct interface assignment.

A
NAT translations exist but no packets are being translated (0 hits), indicating a possible routing or ACL issue.
The 0 hits with 10 misses suggest that translations are created but no successful data flow; packets are missing or not returning.
B
The NAT pool is exhausted.
Why wrong: Only 2 translations exist out of 16 addresses.
C
PAT is enabled but not working.
Why wrong: The mapping does not include 'overload', so PAT is not configured.
D
The inside and outside interfaces are reversed.
Why wrong: The statistics show correct interface assignment.

Question 16hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- --- --- 192.0.2.12 10.0.0.12 --- --- --- 192.0.2.13 10.0.0.13 --- --- --- 192.0.2.14 10.0.0.14 --- --- --- 192.0.2.15 10.0.0.15 --- --- --- 192.0.2.16 10.0.0.16 --- --- --- 192.0.2.17 10.0.0.17 --- --- --- 192.0.2.18 10.0.0.18 --- --- --- 192.0.2.19 10.0.0.19 --- --- --- 192.0.2.20 10.0.0.20 --- ---

R1# show ip nat statistics

Total active translations: 11 (0 static, 11 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 200 Misses: 0 CEF Translated packets: 200, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source

[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240

refcount 11 map-id 1

[Id] ip nat inside source list ACL1 pool POOL1

refcount 11

Based on this output, what is the problem?

Trap 1: PAT is not configured, causing address exhaustion.

While PAT could reduce address usage, the pool is correctly sized for 11 hosts; exhaustion is the immediate problem.

Trap 2: The inside and outside interfaces are misconfigured.

The statistics show correct interface assignment.

Trap 3: Static NAT is conflicting with dynamic NAT.

No static translations are present.

A
The NAT pool is exhausted; no addresses are available for new translations.
All 11 pool addresses are in use, and the pool has no more addresses. New translations will fail.
B
PAT is not configured, causing address exhaustion.
Why wrong: While PAT could reduce address usage, the pool is correctly sized for 11 hosts; exhaustion is the immediate problem.
C
The inside and outside interfaces are misconfigured.
Why wrong: The statistics show correct interface assignment.
D
Static NAT is conflicting with dynamic NAT.
Why wrong: No static translations are present.

Question 17mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- ---

R1# show ip nat statistics

Total active translations: 1 (0 static, 1 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 0 Misses: 0 CEF Translated packets: 0, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source

[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240

refcount 1 map-id 1

[Id] ip nat inside source list ACL1 pool POOL1

refcount 1

Based on this output, what is the problem?

Trap 1: The NAT pool is exhausted.

Only one address is used out of 16.

Trap 2: PAT is misconfigured.

PAT is not configured; this is basic NAT.

Trap 3: The inside and outside interfaces are reversed.

The statistics show correct interface assignment.

A
The NAT translation exists but no traffic is being translated (0 hits, 0 misses), indicating a possible idle translation or no matching traffic.
The translation is present but no packets have been processed. This could be a stale entry or lack of traffic.
B
The NAT pool is exhausted.
Why wrong: Only one address is used out of 16.
C
PAT is misconfigured.
Why wrong: PAT is not configured; this is basic NAT.
D
The inside and outside interfaces are reversed.
Why wrong: The statistics show correct interface assignment.

Question 18easymultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global udp 192.0.2.10:10000 10.0.0.10:10000 203.0.113.5:53 203.0.113.5:53 udp 192.0.2.10:10001 10.0.0.11:10000 203.0.113.5:53 203.0.113.5:53 udp 192.0.2.10:10002 10.0.0.12:10000 203.0.113.5:53 203.0.113.5:53

R1# show ip nat statistics

Total active translations: 3 (0 static, 3 dynamic; 3 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 150 Misses: 0 CEF Translated packets: 150, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source

[Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload

refcount 3

Based on this output, which statement is correct?

Trap 1: The NAT pool is exhausted because all addresses are used.

Only one global address is used (the interface address), and PAT allows sharing.

Trap 2: Static NAT is configured for DNS traffic.

No static translations are present.

Trap 3: The inside and outside interfaces are swapped.

The statistics show correct interface assignment.

A
PAT is working correctly; multiple inside hosts share the same global address with unique ports.
The translations show different source ports for each inside host, and the mapping uses interface overload. Hits indicate successful translation.
B
The NAT pool is exhausted because all addresses are used.
Why wrong: Only one global address is used (the interface address), and PAT allows sharing.
C
Static NAT is configured for DNS traffic.
Why wrong: No static translations are present.
D
The inside and outside interfaces are swapped.
Why wrong: The statistics show correct interface assignment.

Question 19mediummultiple choice

Consider the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside

interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside

ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect of this configuration?

Trap 1: Only traffic from 192.168.1.1 is translated to 203.0.113.1 using…

The ACL permits the entire /24 subnet, not just the router's interface IP.

Trap 2: Traffic is translated using static NAT to 203.0.113.1.

The command uses 'ip nat inside source list' which is dynamic NAT, not static.

Trap 3: The configuration is incomplete; a NAT pool is required for dynamic…

When using an interface with overload, no pool is needed; the interface IP is used.

A
All traffic from 192.168.1.0/24 is translated to 203.0.113.1 using PAT.
The 'overload' keyword enables PAT, and the ACL matches the inside network.
B
Only traffic from 192.168.1.1 is translated to 203.0.113.1 using PAT.
Why wrong: The ACL permits the entire /24 subnet, not just the router's interface IP.
C
Traffic is translated using static NAT to 203.0.113.1.
Why wrong: The command uses 'ip nat inside source list' which is dynamic NAT, not static.
D
The configuration is incomplete; a NAT pool is required for dynamic translation.
Why wrong: When using an interface with overload, no pool is needed; the interface IP is used.

Question 20mediummultiple choice

Given this partial configuration:

ip nat pool MYPOOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool MYPOOL
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect?

Trap 1: Inside hosts are translated to addresses in the pool using PAT.

No 'overload' keyword means no port multiplexing; it's one-to-one dynamic NAT.

Trap 2: The router uses the pool address as the source for all outbound…

The ACL restricts which inside addresses are eligible for translation.

Trap 3: This configuration requires the 'ip nat outside' interface command…

While 'ip nat outside' is needed on the outside interface, the question asks about the effect of the given commands alone; the effect is dynamic NAT without overload.

A
Inside hosts are translated to addresses in the pool using PAT.
Why wrong: No 'overload' keyword means no port multiplexing; it's one-to-one dynamic NAT.
B
Inside hosts are dynamically mapped to a pool address; if the pool is exhausted, new translations fail.
Without overload, each translation consumes one pool address; exhaustion blocks new flows.
C
The router uses the pool address as the source for all outbound traffic, regardless of ACL.
Why wrong: The ACL restricts which inside addresses are eligible for translation.
D
This configuration requires the 'ip nat outside' interface command to function.
Why wrong: While 'ip nat outside' is needed on the outside interface, the question asks about the effect of the given commands alone; the effect is dynamic NAT without overload.