mediumMultiple Select
350-401 Practice Question: Which two statements about NAT configuration on…
Which two statements about NAT configuration on Cisco IOS-XE are true? (Choose two.)
⚠ Common exam trap
350-401 often tests the distinction between dynamic NAT (one-to-one from a pool) and PAT/overload (many-to-one with port translation), plus the correct interface marking (ip nat inside vs ip nat outside), causing candidates to swap the two or misread the overload keyword.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAT overload (PAT) allows multiple internal hosts to share a single public IP address by using unique source port numbers.
Option A is correct because NAT overload, also called PAT, lets many inside hosts share one public IP by multiplexing translations with unique source port numbers, which is exactly how the ip nat inside source list ... overload form operates. Option C is correct because the syntax ip nat inside source static 192.168.1.10 203.0.113.10 creates a one-to-one static NAT mapping between the inside local address 192.168.1.10 and the inside global address 203.0.113.10. Option B is wrong because the overload keyword specifically enables port address translation, so it is not dynamic NAT without port translation. Option D is wrong because ip nat outside is applied to the outside interface, not the internal interface, to mark it as the NAT outside domain. Option E is wrong because dynamic NAT without overload performs one-to-one address translation and does not use port numbers to share a single outside address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NAT overload (PAT) allows multiple internal hosts to share a single public IP address by using unique source port numbers.
Why this is correct
NAT overload, or PAT, multiplexes many inside local addresses onto one inside global address by translating source port numbers, keeping each flow distinct. This satisfies the requirement to share a single public IP across multiple internal hosts simultaneously.
- ✗
The ip nat inside source list 1 pool POOL overload command enables dynamic NAT without port translation.
Why it's wrong here
The overload keyword enables Port Address Translation, mapping many inside hosts to one address using port numbers, so it is not dynamic NAT without port translation. It is tempting because the syntax looks like plain dynamic NAT, but that would omit overload and use a pool without port multiplexing.
- ✓
A static NAT entry is created using the ip nat inside source static 192.168.1.10 203.0.113.10 command.
Why this is correct
The command maps one inside local address to one inside global address, creating a static one-to-one translation entry. It satisfies the static NAT requirement by permanently binding 192.168.1.10 to 203.0.113.10, with no port overloading applied.
- ✗
The ip nat outside command is applied to the internal interface to mark it as the source of NAT translations.
Why it's wrong here
The ip nat outside command marks the external interface facing the untrusted network, not the internal one. It is tempting because both interfaces need NAT designation, but applying outside to the inside interface inverts the translation direction, so traffic is matched on the wrong side.
- ✗
Dynamic NAT without overload translates multiple inside addresses to a single outside address using port numbers.
Why it's wrong here
Dynamic NAT without overload maps inside addresses one-to-one to pool addresses, consuming a public address per host and performing no port translation. It is tempting because overload is often conflated with dynamic NAT, but port-based multiplexing is precisely what the overload keyword adds.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.