The answer is a static and dynamic NAT pool overlap conflict. This occurs because the dynamic NAT pool includes the IP address 192.168.1.10, which is also reserved for the static NAT mapping to the web server. When an external packet arrives destined for that static address, the router may dynamically assign it from the pool to an internal host first, preventing the static translation from ever applying. On the ISC2 Certified in Cybersecurity CC exam, this tests your understanding of NAT ordering and address exclusivity—a common trap is assuming static entries always take priority. Remember that dynamic pools are checked before static mappings in many implementations, so overlapping addresses cause silent failures. Memory tip: "Static first, pool last—if they clash, the pool will smash the static."
ISC2 CC Network Security Practice Question
This CC practice question tests your understanding of network security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
ip nat inside source static tcp 192.168.1.10 80 200.100.50.1 80
ip nat pool POOL 200.100.50.1 200.100.50.10 netmask 255.255.255.0
ip nat inside source list 1 pool POOL overload
access-list 1 permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/0
ip address 200.100.50.1 255.255.255.0
ip nat outside
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
Refer to the exhibit. The network administrator configured NAT as shown. Internal hosts can access the internet, but no external hosts can access the company's web server (192.168.1.10). What is the issue?
ip nat inside source static tcp 192.168.1.10 80 200.100.50.1 80
ip nat pool POOL 200.100.50.1 200.100.50.10 netmask 255.255.255.0
ip nat inside source list 1 pool POOL overload
access-list 1 permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/0
ip address 200.100.50.1 255.255.255.0
ip nat outside
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
A
The static NAT is being overridden by the dynamic NAT
Why wrong: Static NAT takes precedence, but the conflict still causes issues.
B
The outside interface should be the inside interface
Why wrong: The outside interface is correctly identified as the internet-facing interface.
C
The web server is not in the access-list
Why wrong: The access-list permits the entire subnet 192.168.1.0/24, which includes the web server.
D
The pool includes the static IP causing conflict
The pool range includes 200.100.50.1, which is already used by the static NAT, causing a conflict.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The pool includes the static IP causing conflict
The correct answer is D because the dynamic NAT pool includes the IP address 192.168.1.10, which is also used for the static NAT mapping to the web server. When a packet arrives from the internet destined for the static NAT address, the router first checks dynamic NAT entries and may assign that address from the pool to an internal host, causing a conflict and preventing the static translation from being applied. This is a classic IP address overlap issue where the pool should exclude the static NAT address.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The static NAT is being overridden by the dynamic NAT
Why it's wrong here
Static NAT takes precedence, but the conflict still causes issues.
✗
The outside interface should be the inside interface
Why it's wrong here
The outside interface is correctly identified as the internet-facing interface.
✗
The web server is not in the access-list
Why it's wrong here
The access-list permits the entire subnet 192.168.1.0/24, which includes the web server.
✓
The pool includes the static IP causing conflict
Why this is correct
The pool range includes 200.100.50.1, which is already used by the static NAT, causing a conflict.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the misconception that static NAT always overrides dynamic NAT, but the trap here is that an overlapping pool address causes a conflict that prevents the static translation from being installed, not a priority issue.
Detailed technical explanation
How to think about this question
Under the hood, Cisco IOS maintains separate translation tables for static and dynamic NAT, but when a pool overlaps with a static NAT address, the router may create a dynamic translation for that IP before the static entry is consulted, leading to a 'NAT conflict' where the router cannot determine which translation to use. In real-world scenarios, this often occurs when administrators forget to exclude the static IP from the pool using the 'ip nat pool' command with the 'exclude' keyword or by adjusting the pool range. The router's behavior is defined by RFC 2663, which states that static mappings should take precedence, but implementation details in Cisco IOS can cause the dynamic entry to be created first if the address is available in the pool.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Network Security — This question tests Network Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The pool includes the static IP causing conflict — The correct answer is D because the dynamic NAT pool includes the IP address 192.168.1.10, which is also used for the static NAT mapping to the web server. When a packet arrives from the internet destined for the static NAT address, the router first checks dynamic NAT entries and may assign that address from the pool to an internal host, causing a conflict and preventing the static translation from being applied. This is a classic IP address overlap issue where the pool should exclude the static NAT address.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.