350-401 Architecture Practice Question
A network engineer is configuring a Cisco IOS XE router to support Network Address Translation (NAT) for a small office. The router has an inside interface GigabitEthernet0/0/0 and an outside interface GigabitEthernet0/0/1. The engineer wants to translate all inside hosts to the outside interface IP address using PAT. Which configuration snippet correctly implements this?
⚠ Common exam trap
Test-takers frequently confuse static NAT or pool-based NAT with PAT to an interface, when the scenario explicitly requires translating all inside hosts to the outside interface IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip nat inside source list 1 interface GigabitEthernet0/0/1 overload; interface GigabitEthernet0/0/0: ip nat inside; interface GigabitEthernet0/0/1: ip nat outside; access-list 1 permit 192.168.1.0 0.0.0.255
The correct PAT configuration for translating all inside hosts to the outside interface IP uses the ip nat inside source list command with the interface keyword and overload. The access list defines the inside subnet, and interfaces are marked inside and outside. Static NAT, NAT pools, and outside source NAT do not meet the specific requirement of translating all inside hosts to the outside interface IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ip nat inside source static 192.168.1.10 203.0.113.1; interfaces marked inside/outside; no access-list needed
Why it's wrong here
Static NAT maps a single inside host to a single outside address, which does not provide PAT for all inside hosts. The scenario requires translating all inside hosts to the outside interface IP using PAT, not a one-to-one static mapping. Static NAT would only allow one host to communicate, leaving others untranslated, so it fails the requirement.
- ✓
ip nat inside source list 1 interface GigabitEthernet0/0/1 overload; interface GigabitEthernet0/0/0: ip nat inside; interface GigabitEthernet0/0/1: ip nat outside; access-list 1 permit 192.168.1.0 0.0.0.255
Why this is correct
This configuration uses PAT overload by referencing the outside interface in the ip nat inside source command, which translates all inside hosts to the outside interface IP. The access list defines the inside subnet, and the interfaces are marked correctly as inside and outside. This is the standard method for PAT to a single outside address, matching the requirement.
- ✗
ip nat inside source list 1 pool MYPOOL overload; ip nat pool MYPOOL 203.0.113.1 203.0.113.1 netmask 255.255.255.0; interfaces marked inside/outside; access-list 1 permit 192.168.1.0 0.0.0.255
Why it's wrong here
This uses a NAT pool with a single address, which can achieve PAT, but the scenario specifies translating to the outside interface IP address, not a pool. While functionally similar, the pool approach requires an extra configuration object and does not directly reference the interface. The requirement is to use the outside interface IP, so the pool method is not the exact match, though it could work.
- ✗
ip nat outside source list 1 interface GigabitEthernet0/0/0 overload; interfaces marked inside/outside; access-list 1 permit any
Why it's wrong here
This command translates outside source addresses to the inside interface, which is the reverse of what is needed. The scenario requires inside hosts to be translated to the outside interface for internet access. Using ip nat outside source would apply NAT to traffic entering from the outside, which is incorrect for the described PAT requirement and would not translate inside hosts.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.