NSE4 Firewall Policies and NAT Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Fixed port range NAT

  Why it's wrong here

  Fixed port range NAT allocates a contiguous block of destination ports (e.g., 500 ports) for each internal host's outbound sessions, so a single public IP can only support a limited number of hosts before exhausting the 16-bit port space. Additionally, each host is confined to its assigned port range, which caps the number of concurrent sessions per host. To scale beyond a few hosts, multiple public IPs become mandatory, making this method impractical for mass internal IP translation.

• ✗

  One-to-one NAT

  Why it's wrong here

  One-to-one NAT creates a static 1:1 binding between an internal IP and a public IP, meaning every internal host requires its own dedicated public address. Since it does not modify the source port, the NAT engine cannot multiplex multiple internal hosts behind a single public IP. This approach consumes IP address space linearly and fails when the goal is to represent many internal hosts using only one public IP.

• ✗

  Central SNAT without overload

  Why it's wrong here

  Central SNAT without overload translates the source IP of all internal hosts to a single public IP but does not enable port address translation (PAT). Without PAT, the NAT device cannot uniquely identify return traffic for multiple internal hosts that happen to use the same source port, because the source port is left unchanged. This effectively limits the entire internal network to one active session per destination port, making it equivalent to a single-host NAT and unusable for large-scale translation.

• ✓

  Overload NAT (Port Address Translation)

  Why this is correct

  Overload NAT, also known as Port Address Translation (PAT), allows many internal hosts to share one public IP by rewriting not only the source IP but also the source port to a unique, dynamically assigned value. The NAT engine maintains a translation table keyed by the public IP and the new source port, so return traffic is correctly forwarded back to the original internal host. This session multiplexing is what makes a single public IP sufficient for the entire internal network, with a theoretical maximum of about 65,536 concurrent sessions per public IP.

Go deeper

Related to this question