N10-009 Network Implementation Practice Question
A company is implementing a DMZ to host public-facing web and email servers. The DMZ network uses private IP addresses, and the internal network also uses private IP addresses. The company has only one public IP address assigned to the border router's external interface. Which of the following should be configured to allow internet users to access the DMZ servers?
⚠ Common exam trap
Candidates often confuse PAT (overload NAT) with port forwarding, assuming that PAT alone can handle inbound connections, when in fact PAT only supports outbound-initiated sessions unless explicit port forwarding rules are configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port forwarding to the private IP addresses of the servers.
Port forwarding (often configured as static NAT with a single public IP) allows the border router to forward incoming traffic on specific TCP/UDP ports (e.g., 80 for web, 25 for SMTP) to the private IP addresses of the DMZ servers. Since the company has only one public IP, this is the only way to direct external requests to the correct internal server without requiring multiple public IPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Port forwarding to the private IP addresses of the servers.
Why this is correct
Port forwarding, also known as Destination Network Address Translation (DNAT), is the correct method for allowing external internet users to access public-facing servers located in a DMZ that utilize private IP addresses. It configures the firewall or router to listen for incoming connections on a specific public IP address and port, then transparently redirects that traffic to the corresponding private IP address and port of the internal server. This enables multiple services, like web and email, to be hosted on different servers behind a single public IP.
- ✗
NAT with overload to translate multiple internal addresses to the single public IP.
Why it's wrong here
NAT with overload, commonly known as Port Address Translation (PAT), is designed to allow multiple internal private IP addresses to share a single public IP address for *outbound* connections. It achieves this by assigning unique source port numbers to each outgoing connection. This mechanism is specifically for internal hosts initiating traffic to external destinations and does not facilitate *inbound* connections from external users to specific internal servers in a DMZ.
When this WOULD be correct
A company has multiple internal hosts needing internet access but only one public IP. NAT with overload (PAT) would be correct to translate all internal private IPs to the single public IP for outbound connections.
- ✗
Static NAT mapping each DMZ server to a unique public IP.
Why it's wrong here
Static NAT involves a one-to-one mapping where each private IP address is permanently translated to a unique public IP address. This approach is unsuitable when only a single public IP address is available for multiple distinct DMZ servers, such as both a web server and an email server. Implementing Static NAT for each server would exhaust the limited public IP resource, as it dedicates an entire public IP to a single private host.
When this WOULD be correct
Static NAT would be correct if the company had multiple public IP addresses and needed to map each DMZ server to a dedicated public IP for direct inbound access without port differentiation.
- ✗
A VPN tunnel between the DMZ and the internal network.
Why it's wrong here
A VPN tunnel primarily establishes a secure, encrypted communication channel between two networks or a remote client and a network. While it could secure traffic *between* the DMZ and the internal network, its fundamental purpose is not to provide external internet users with direct access to public-facing services within the DMZ. It focuses on confidentiality and integrity for internal or inter-site communication, rather than exposing services to the broader internet.
When this WOULD be correct
A VPN tunnel would be correct if the question asked for securing traffic between the DMZ and internal network, or if remote employees needed secure access to internal resources through the DMZ.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Port forwarding to the private IP addresses of the servers.Correct answer▾
Why this is correct
Port forwarding, also known as Destination Network Address Translation (DNAT), is the correct method for allowing external internet users to access public-facing servers located in a DMZ that utilize private IP addresses. It configures the firewall or router to listen for incoming connections on a specific public IP address and port, then transparently redirects that traffic to the corresponding private IP address and port of the internal server. This enables multiple services, like web and email, to be hosted on different servers behind a single public IP.
✗NAT with overload to translate multiple internal addresses to the single public IP.Wrong answer — click to see why▾
Why this is wrong here
NAT with overload (PAT) allows multiple internal hosts to share a single public IP for outbound traffic, but it does not enable inbound access from the internet to specific private IPs in the DMZ. The question requires inbound access to servers, which is achieved by port forwarding, not overload.
★ When this WOULD be the correct answer
A company has multiple internal hosts needing internet access but only one public IP. NAT with overload (PAT) would be correct to translate all internal private IPs to the single public IP for outbound connections.
Why candidates choose this
Candidates may confuse NAT overload with port forwarding, thinking that sharing a single public IP implies inbound access, but overload is for outbound traffic only.
✗Static NAT mapping each DMZ server to a unique public IP.Wrong answer — click to see why▾
Why this is wrong here
Static NAT requires a unique public IP for each DMZ server, but the company has only one public IP address, making this option impossible.
★ When this WOULD be the correct answer
Static NAT would be correct if the company had multiple public IP addresses and needed to map each DMZ server to a dedicated public IP for direct inbound access without port differentiation.
Why candidates choose this
Candidates may confuse static NAT with port forwarding, assuming that each server needs its own public IP, or they may overlook the constraint of having only one public IP.
✗A VPN tunnel between the DMZ and the internal network.Wrong answer — click to see why▾
Why this is wrong here
A VPN tunnel between the DMZ and internal network does not provide internet users access to DMZ servers; it only secures communication between the DMZ and internal network. The question requires external access from the internet, not internal connectivity.
★ When this WOULD be the correct answer
A VPN tunnel would be correct if the question asked for securing traffic between the DMZ and internal network, or if remote employees needed secure access to internal resources through the DMZ.
Why candidates choose this
Candidates may confuse DMZ security requirements with VPN use, thinking a tunnel is needed to protect DMZ servers, but the actual need is inbound access from the internet.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Physical Network Infrastructure
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.