NAT practice questions with answers

Answer: B

The inside global address is how an inside host appears to the outside world, here 203.0.113.5. The inside local address is the host real address, 10.1.1.10. The server address 198.51.100.7 is an outside address (outside global, and outside local too unless outside NAT is used). A router interface address is not a NAT term at all.

Answer: D

Static NAT creates a permanent one-to-one mapping that exists whether or not traffic flows, so outside hosts can initiate connections to the server. Dynamic NAT builds entries on demand from a pool when inside hosts send traffic, so nothing exists for an outside host to connect to. PAT also creates entries only from inside traffic and shares addresses by port. Outside source NAT translates addresses of outside hosts, not the inside server.

Answer: A

ip nat inside source list 10 interface GigabitEthernet0/0/1 overload translates addresses matched by ACL 10 to the interface address and tells the router to use unique port numbers (PAT), so one address serves many hosts. Without overload, the interface address could be used by one inside host at a time. ip nat outside source translates outside hosts, which is not the goal. A static entry maps one inside host only and would not serve 200 PCs.

Answer: C

The router must know which interfaces face the inside and the outside. ip nat inside on the LAN interface and ip nat outside on the WAN interface mark the direction in which translation happens; without them the global command never matches any traffic. Overload is already present. Changing the ACL to deny would stop hosts from being translated at all. A loopback interface plays no part in this translation.

Answer: B

Without overload, each translation uses a whole pool address, so with three addresses in use the pool is exhausted. The packet from the fourth host is dropped (the router returns an ICMP host unreachable) until an existing entry times out or is cleared. NAT does not reuse an address by adding port numbers unless overload is configured. Forwarding the packet untranslated and borrowing the interface address are not behaviors of a pool without overload.

Answer: A

The second column is the inside global address and port, the third the inside local. Host 10.1.1.10 used source port 51000, and the router rewrote it to port 1024 on 203.0.113.5, which is PAT behavior. 198.51.100.7 is in the outside columns, not an inside global address. A static one-to-one entry would show no port numbers. 203.0.113.5:1024 belongs to the translated inside host, not to the server.

Answer: D

In NAT the ACL only selects which inside local addresses are translated; it is not a filter. 10.1.2.5 does not match the permit statement, so the NAT process ignores it and the packet is routed normally with its private source address, where the ISP will typically discard it. NAT does not send an ICMP error for unmatched traffic. The interface address is used only for hosts that match the ACL. The router has no reason to refuse to forward the packet.

Answer: C

The syntax is ip nat inside source static followed by the inside local address and then the inside global address, so ip nat inside source static 10.1.1.20 203.0.113.20 is correct. The version with the two addresses reversed describes a different mapping. ip nat outside source static is for translating outside hosts. Specifying an address where an ACL number or name belongs is invalid syntax for a list-based command.

Answer: B

Without overload this is dynamic NAT that maps one inside host to the single interface address, so only one host can hold a translation at a time. Adding overload enables PAT, which lets many hosts share the address by using different port numbers. Removing the ACL would stop translation. ip nat outside is already needed and present, since the first PC works. A second pool cannot help because the interface provides only one address.

Answer: A

clear ip nat translation * removes all dynamic translation entries; static entries created with ip nat inside source static stay. clear ip nat statistics only resets the counters and leaves the table alone. Removing ip nat inside from the interface changes the configuration and stops translation. clear ip route * affects the routing table, not the NAT table.

Answer: C

PAT keeps one translation entry per flow. For the second flow it rewrites the source port to an unused port on the inside global address, so the return traffic can be mapped back to the correct inside host. It does not drop the second session. NAT works on IP addresses and Layer 4 ports and does not use MAC addresses for this. It does not take a second public address, because overload shares the one it has.

Answer: D

For ICMP echo, Cisco IOS translates the ICMP query identifier instead of a port number, so each echo reply can be matched to its translation entry. Port 7 is the echo service port for the old UDP and TCP echo protocols and is not part of ICMP. MAC addresses are rewritten at every router hop and are not used for translation. The TTL value is decremented at each hop and does not identify a flow.

Answer: A

Traffic from the inside enters the router on the inside interface before NAT is applied, so an inbound ACL there sees the original inside local address, such as 10.1.1.10. The inside global address is created only when the packet is translated on its way out, after the inbound ACL check. The outside local and outside global addresses describe the destination server, not the source.

Answer: D

An entry without protocol and port numbers is a one-to-one address translation, created either by a static command or by dynamic NAT without overload. PAT entries always carry protocol and port values, so this is not PAT or an overload entry. Nothing in it indicates outside source NAT, because the outside columns hold no translation. The entry cannot be called a TCP entry, since the protocol field is empty.

Answer: C

Traffic from the outside is checked by the inbound ACL on the outside interface before the outside-to-inside translation, so the packet still carries the inside global destination address 203.0.113.20 and the ACL must permit that address. Matching 10.1.1.20 would fail, because the packet has not been translated yet. The server real subnet and the router interface address are not the destination of these packets.