Cisco 200-301 Exam Dumps, Practice Test Questions

100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Cisco 200-301 Premium Bundle
$79.97
$59.98

200-301 Premium Bundle

  • Premium File: 760 Questions & Answers. Last update: Nov 12, 2026
  • Training Course: 271 Video Lectures
  • Study Guide: 1969 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

200-301 Premium Bundle

Cisco 200-301 Premium Bundle
  • Premium File: 760 Questions & Answers. Last update: Nov 12, 2026
  • Training Course: 271 Video Lectures
  • Study Guide: 1969 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Cisco 200-301 Practice Test 53

Question 520

A host has ARP-resolved the default gateway IP of an HSRPv1 group to its **virtual MAC address**. Router A fails and Router B becomes HSRP active; both implement the normal virtual-IP/MAC scheme. What MAC address should the host continue using as destination for off-subnet frames?

  1. The HSRP virtual MAC address already associated with its virtual default-gateway IP
  2. Router A’s burned-in physical MAC even though it failed
  3. Router B’s physical burned-in MAC instead of the HSRP virtual MAC
  4. The Ethernet broadcast MAC address for every routed IPv4 packet

Explanation

Correct Answer

A:

HSRP failover moves ownership of the same virtual gateway identity to Router B, so the host normally retains the virtual MAC destination.

Incorrect Answers

B:

Router A’s physical address is not the HSRP virtual identity and becomes unusable after failure.

C:

Although Router B transmits its own frames with its physical address, hosts use the HSRP virtual MAC as their default-gateway destination.

D:

Broadcast Ethernet is used for some discovery traffic such as ARP requests, not the destination MAC for every routed unicast packet.

Question 521

A branch router routes between inside user VLAN 10 (10.10.1.0/24) on Gi0/0 and the ISP on Gi0/1. The engineer has already configured inside-source NAT. Which interface classification is required on Gi0/0?

  1. ip nat outside on Gi0/0
  2. ip nat inside source static 10.10.1.20 203.0.113.20 under Gi0/0
  3. Configure ip nat inside on the LAN-facing interface
  4. show ip nat translations under Gi0/0

Explanation

Correct Answer

C:

The inside classification belongs on Gi0/0 facing private user addresses, so inside-source NAT knows the packet is arriving from the internal address domain.

Incorrect Answers

A:

Marking the user-facing LAN as outside reverses the intended NAT direction and does not designate inside hosts as the source network.

B:

Static inside-source translations are configured in global mode; the requirement here is interface classification, not a one-to-one mapping.

D:

The show command is read-only operational verification and does not mark an interface as a NAT inside boundary.

Question 522

A Cisco border router already marks its office LAN interface `ip nat inside`. Packets leave toward the provider on Gi0/1 where the source addresses are translated. Which classification belongs on Gi0/1?

  1. ip nat inside on Gi0/1
  2. Configure ip nat outside on the WAN-facing interface
  3. show ip nat statistics
  4. ip nat inside source list 10 interface Gi0/1 overload as an interface command

Explanation

Correct Answer

B:

The provider-facing Gi0/1 is classified as `ip nat outside`; traffic crosses the inside/outside roles under the configured inside-source NAT policy.

Incorrect Answers

A:

Marking both edges as inside would not identify the WAN as the external NAT-facing direction needed for inside-source translation.

C:

Statistics report counters and pool state but do not label the physical WAN interface for NAT operation.

D:

The overload translation policy is configured globally; it does not replace the required interface-level outside designation.

Question 523

An internal host 10.10.1.20 needs a persistent one-to-one external identity 203.0.113.20 through an IOS NAT edge. Which static inside-source NAT rule creates exactly that mapping?

  1. Use ip nat inside source list 10 interface Gi0/1 overload instead of a host mapping
  2. Configure ip nat inside source static 10.10.1.20 203.0.113.20
  3. Use ip nat outside source static 10.10.1.20 203.0.113.20
  4. Use ip nat inside source static 10.10.1.21 203.0.113.20

Explanation

Correct Answer

B:

Static NAT makes a fixed mapping between an inside-local host and its inside-global address. Unlike dynamic overload, it does not rely on choosing an ephemeral port to multiplex many inside hosts onto one public address.

Incorrect Answers

A:

PAT overload shares one interface IP across many sessions; it does not reserve one stable 203.0.113.20 identity for 10.10.1.20.

C:

Outside-source NAT translates the other direction of address role and is not the requested inside-source host mapping.

D:

The inside address differs from the named internal host and would map a different device.

Question 524

Connections through an IOS NAT router succeed, but an operator needs to see individual inside-local to inside-global translation entries rather than just aggregate counters. Which command displays those translations?

  1. Run show ip nat statistics and read only translation totals
  2. Run show ip route and infer translated global addresses from routes
  3. Run show ip nat translations
  4. Run show access-lists and assume matching statements enumerate all NAT sessions

Explanation

Correct Answer

C:

The NAT translation table lists active inside-local and inside-global mappings.

Incorrect Answers

A:

Aggregate counters summarize use but do not list the individual inside-local/inside-global tuple entries requested.

B:

The routing table contains prefixes and next hops rather than active NAT translation mappings.

D:

An ACL may select NAT candidates but does not display every active inside/outside mapping.

Question 525

The NOC wants a summary of active NAT translations, pool utilization, misses and related statistics rather than every session mapping. Which IOS command reports NAT statistics?

  1. Run show ip nat translations and count every active entry manually
  2. Run show interfaces Gi0/1 to read only packet/error counters
  3. Run show ip route static to count reachable Internet prefixes
  4. Run show ip nat statistics

Explanation

Correct Answer

D:

The NAT statistics output reports translation counts, hits, misses and pool usage.

Incorrect Answers

A:

That can show individual translations, but show ip nat statistics directly provides the aggregate hit/miss and pool summary requested.

B:

Physical interface counters do not expose NAT pool utilization and translation statistics.

C:

Installed route information does not describe NAT allocation pool and hit/miss counters.

Question 526

Dynamic NAT must lease external addresses 203.0.113.100 through 203.0.113.105 from the site's 203.0.113.0/24 allocation. Which named address pool definition captures this exact span?

  1. Create ip nat pool OUTSIDE 203.0.113.100 203.0.113.120 netmask 255.255.255.0
  2. Use ip nat inside source static 203.0.113.100 203.0.113.105
  3. Define ip nat pool OUTSIDE 203.0.113.100 203.0.113.105 netmask 255.255.255.0
  4. Create ip nat pool OUTSIDE 203.0.113.100 203.0.113.105 netmask 255.255.255.248

Explanation

Correct Answer

C:

The named pool provides usable global addresses for dynamic one-to-one translations.

Incorrect Answers

A:

The ending address .120 exceeds the approved .105 pool boundary.

B:

A static inside-source mapping is not the six-address named allocation pool required here.

D:

A /29 mask does not correctly describe the specified source /24 global allocation and would not preserve the requested pool context.

Question 527

An inside-source dynamic NAT rule must translate hosts only from 10.10.1.0/24. Which standard IPv4 ACL function should select those inside-source addresses?

  1. Permit the 203.0.113.0/24 outside pool as the source ACL match
  2. Create an appropriate standard ACL matching the internal sources
  3. Match the entire 10.0.0.0/8 inside address space
  4. Match only the destination 0.0.0.0/0 with no inside-source selection

Explanation

Correct Answer

B:

The NAT source ACL identifies which inside-local addresses can use the pool.

Incorrect Answers

A:

The selection ACL should match inside-local 10.10.1.0/24 addresses, not addresses allocated after NAT.

C:

That would select many internal hosts beyond the authorized 10.10.1.0/24 and violate the restriction.

D:

The standard ACL for inside-source NAT should identify eligible source addresses, not substitute a destination wildcard.

Question 528

An IOS edge has a configured standard ACL 10 and external pool OUTSIDE. Hosts matching ACL 10 need dynamic one-to-one pool addresses, **not** interface PAT overload. Which NAT mapping command meets this requirement?

  1. Use ip nat inside source list 10 interface Gi0/1 overload
  2. Use ip nat inside source static 10.10.1.20 203.0.113.20
  3. Configure ip nat inside source list 10 pool OUTSIDE
  4. Use ip nat pool OUTSIDE ... alone without linking ACL 10 to it

Explanation

Correct Answer

C:

This NAT statement links the selected internal addresses with the external address pool.

Incorrect Answers

A:

That is PAT through a single outside interface address, not dynamic 1:1 use of named pool OUTSIDE.

B:

A single static host mapping would not dynamically allocate outside addresses to all hosts selected by ACL 10.

D:

Defining a pool is not sufficient; the inside source ACL must be bound to the pool by the mapping rule.

Question 529

LAN hosts in Gi0/0 need NAT when reaching the ISP on Gi0/1. Which direction role must be assigned to the Gi0/0 LAN-facing interface, not the ISP link?

  1. Apply ip nat outside to Gi0/0 and inside to Gi0/1
  2. Apply ip nat inside to both Gi0/0 and Gi0/1
  3. Configure only an inside-source mapping without marking any NAT inside/outside interfaces
  4. Apply ip nat inside on the internal interface

Explanation

Correct Answer

D:

Inside source NAT uses the configured inside/outside interface roles.

Incorrect Answers

A:

This reverses the stated trusted LAN versus ISP directions for the inside-source NAT policy.

B:

The ISP-facing side must be identified as outside, not another inside interface.

C:

The mapping rule alone does not define which routed interfaces participate as NAT inside and outside.

Question 530

A branch router already has inside/outside interface roles and standard ACL 10 matching authorized inside hosts. The WAN interface is GigabitEthernet0/0 with one provider global IPv4 address. Which global IOS command lets multiple inside clients share that interface address using TCP/UDP port translations?

  1. ip nat inside source list 10 interface GigabitEthernet0/0 overload
  2. ip nat inside source list 10 pool POOL without overload
  3. ip nat inside source static 10.1.1.10 203.0.113.10
  4. no ip nat inside on the LAN interface

Explanation

Correct Answer

A:

Inside-source PAT with the `overload` keyword can multiplex multiple inside flows through the WAN interface address using transport-port identifiers.

Incorrect Answers

B:

Dynamic pool NAT without overloading assigns global address translations but does not explicitly reuse one interface address with transport-port multiplexing.

C:

A static one-to-one mapping binds one inside host to one global address and does not supply generalized PAT for many users.

D:

Removing the inside role would prevent normal inside-source NAT for that LAN, not enable shared overload.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.