mediumMultiple ChoiceObjective-mapped
Reading Static NAT Translation Output
A network engineer runs the following command on Router R7:
R7# show ip nat translations verbose
Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:05:00 timeout: never, flags: static --- 192.0.2.11 10.0.0.11 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:06:00 timeout: never, flags: static
Based on this output, what can be concluded?
Quick Answer
The correct conclusion is that the translations are static and will remain until manually removed. This is because the verbose output of the `show ip nat translations` command explicitly displays `timeout: never` and `flags: static` for each entry, which indicates these mappings are not dynamic and will not be aged out by any timer. When interpreting static NAT translation output on the ENCOR 350-401 exam, you must recognize that static entries lack an outside local or outside global address (shown as `---`) and are manually configured, unlike dynamic NAT which will show a timeout value and a `dynamic` flag. A common trap is assuming that all NAT entries eventually time out, but the `flags: static` field is your definitive clue. For a quick memory tip, remember: “Static never times out—if you see ‘never’ and ‘static’, it’s permanent until you delete it.”
⚠ Common exam trap
Cisco often tests the distinction between static and dynamic NAT by hiding the 'flags' field or using the 'timeout' value; candidates may incorrectly assume all NAT entries have a timeout or that the presence of 'use' timestamps implies dynamic behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The translations are static and will remain until manually removed.
The output shows two NAT entries with the flag 'static' and a timeout of 'never'. Static NAT translations are manually configured and persist indefinitely in the translation table until explicitly removed by an administrator. This is why option D is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
These translations will expire after a configurable timeout.
Why it's wrong here
The timeout is 'never', so they do not expire.
- ✗
The translations are dynamic and will be removed after idle timeout.
Why it's wrong here
The flags indicate 'static', not dynamic.
- ✗
The router is performing PAT for these addresses.
Why it's wrong here
No protocol or port is shown; these are simple static NAT entries.
- ✓
The translations are static and will remain until manually removed.
Why this is correct
Static NAT entries with timeout 'never' persist indefinitely.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-401 question is part of Courseiva's 1,175-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- --- Based on this output, what can be concluded?
medium- A.Dynamic NAT is configured with a pool of addresses.
- ✓ B.Static NAT is configured for two internal hosts.
- C.PAT is translating multiple internal addresses to a single global address.
- D.NAT is not operational because no outside local addresses are shown.
Why B: The output shows two inside global addresses (192.0.2.10 and 192.0.2.11) mapped one-to-one to inside local addresses (10.0.0.10 and 10.0.0.11), with no outside local or outside global entries. This is characteristic of static NAT, where each internal host is permanently assigned a specific global address, typically configured with 'ip nat inside source static' commands.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.