100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 520
A host has ARP-resolved the default gateway IP of an HSRPv1 group to its **virtual MAC address**. Router A fails and Router B becomes HSRP active; both implement the normal virtual-IP/MAC scheme. What MAC address should the host continue using as destination for off-subnet frames?
- The HSRP virtual MAC address already associated with its virtual default-gateway IP
- Router A’s burned-in physical MAC even though it failed
- Router B’s physical burned-in MAC instead of the HSRP virtual MAC
- The Ethernet broadcast MAC address for every routed IPv4 packet
Explanation
Correct Answer
A:HSRP failover moves ownership of the same virtual gateway identity to Router B, so the host normally retains the virtual MAC destination.
Incorrect Answers
B:Router A’s physical address is not the HSRP virtual identity and becomes unusable after failure.
C:Although Router B transmits its own frames with its physical address, hosts use the HSRP virtual MAC as their default-gateway destination.
D:Broadcast Ethernet is used for some discovery traffic such as ARP requests, not the destination MAC for every routed unicast packet.
Question 521
A branch router routes between inside user VLAN 10 (10.10.1.0/24) on Gi0/0 and the ISP on Gi0/1. The engineer has already configured inside-source NAT. Which interface classification is required on Gi0/0?
- ip nat outside on Gi0/0
- ip nat inside source static 10.10.1.20 203.0.113.20 under Gi0/0
- Configure ip nat inside on the LAN-facing interface
- show ip nat translations under Gi0/0
Explanation
Correct Answer
C:The inside classification belongs on Gi0/0 facing private user addresses, so inside-source NAT knows the packet is arriving from the internal address domain.
Incorrect Answers
A:Marking the user-facing LAN as outside reverses the intended NAT direction and does not designate inside hosts as the source network.
B:Static inside-source translations are configured in global mode; the requirement here is interface classification, not a one-to-one mapping.
D:The show command is read-only operational verification and does not mark an interface as a NAT inside boundary.
Question 522
A Cisco border router already marks its office LAN interface `ip nat inside`. Packets leave toward the provider on Gi0/1 where the source addresses are translated. Which classification belongs on Gi0/1?
- ip nat inside on Gi0/1
- Configure ip nat outside on the WAN-facing interface
- show ip nat statistics
- ip nat inside source list 10 interface Gi0/1 overload as an interface command
Explanation
Correct Answer
B:The provider-facing Gi0/1 is classified as `ip nat outside`; traffic crosses the inside/outside roles under the configured inside-source NAT policy.
Incorrect Answers
A:Marking both edges as inside would not identify the WAN as the external NAT-facing direction needed for inside-source translation.
C:Statistics report counters and pool state but do not label the physical WAN interface for NAT operation.
D:The overload translation policy is configured globally; it does not replace the required interface-level outside designation.
Question 523
An internal host 10.10.1.20 needs a persistent one-to-one external identity 203.0.113.20 through an IOS NAT edge. Which static inside-source NAT rule creates exactly that mapping?
- Use ip nat inside source list 10 interface Gi0/1 overload instead of a host mapping
- Configure ip nat inside source static 10.10.1.20 203.0.113.20
- Use ip nat outside source static 10.10.1.20 203.0.113.20
- Use ip nat inside source static 10.10.1.21 203.0.113.20
Explanation
Correct Answer
B:Static NAT makes a fixed mapping between an inside-local host and its inside-global address. Unlike dynamic overload, it does not rely on choosing an ephemeral port to multiplex many inside hosts onto one public address.
Incorrect Answers
A:PAT overload shares one interface IP across many sessions; it does not reserve one stable 203.0.113.20 identity for 10.10.1.20.
C:Outside-source NAT translates the other direction of address role and is not the requested inside-source host mapping.
D:The inside address differs from the named internal host and would map a different device.
Question 524
Connections through an IOS NAT router succeed, but an operator needs to see individual inside-local to inside-global translation entries rather than just aggregate counters. Which command displays those translations?
- Run show ip nat statistics and read only translation totals
- Run show ip route and infer translated global addresses from routes
- Run show ip nat translations
- Run show access-lists and assume matching statements enumerate all NAT sessions
Explanation
Correct Answer
C:The NAT translation table lists active inside-local and inside-global mappings.
Incorrect Answers
A:Aggregate counters summarize use but do not list the individual inside-local/inside-global tuple entries requested.
B:The routing table contains prefixes and next hops rather than active NAT translation mappings.
D:An ACL may select NAT candidates but does not display every active inside/outside mapping.
Question 525
The NOC wants a summary of active NAT translations, pool utilization, misses and related statistics rather than every session mapping. Which IOS command reports NAT statistics?
- Run show ip nat translations and count every active entry manually
- Run show interfaces Gi0/1 to read only packet/error counters
- Run show ip route static to count reachable Internet prefixes
- Run show ip nat statistics
Explanation
Correct Answer
D:The NAT statistics output reports translation counts, hits, misses and pool usage.
Incorrect Answers
A:That can show individual translations, but show ip nat statistics directly provides the aggregate hit/miss and pool summary requested.
B:Physical interface counters do not expose NAT pool utilization and translation statistics.
C:Installed route information does not describe NAT allocation pool and hit/miss counters.
Question 526
Dynamic NAT must lease external addresses 203.0.113.100 through 203.0.113.105 from the site's 203.0.113.0/24 allocation. Which named address pool definition captures this exact span?
- Create ip nat pool OUTSIDE 203.0.113.100 203.0.113.120 netmask 255.255.255.0
- Use ip nat inside source static 203.0.113.100 203.0.113.105
- Define ip nat pool OUTSIDE 203.0.113.100 203.0.113.105 netmask 255.255.255.0
- Create ip nat pool OUTSIDE 203.0.113.100 203.0.113.105 netmask 255.255.255.248
Explanation
Correct Answer
C:The named pool provides usable global addresses for dynamic one-to-one translations.
Incorrect Answers
A:The ending address .120 exceeds the approved .105 pool boundary.
B:A static inside-source mapping is not the six-address named allocation pool required here.
D:A /29 mask does not correctly describe the specified source /24 global allocation and would not preserve the requested pool context.
Question 527
An inside-source dynamic NAT rule must translate hosts only from 10.10.1.0/24. Which standard IPv4 ACL function should select those inside-source addresses?
- Permit the 203.0.113.0/24 outside pool as the source ACL match
- Create an appropriate standard ACL matching the internal sources
- Match the entire 10.0.0.0/8 inside address space
- Match only the destination 0.0.0.0/0 with no inside-source selection
Explanation
Correct Answer
B:The NAT source ACL identifies which inside-local addresses can use the pool.
Incorrect Answers
A:The selection ACL should match inside-local 10.10.1.0/24 addresses, not addresses allocated after NAT.
C:That would select many internal hosts beyond the authorized 10.10.1.0/24 and violate the restriction.
D:The standard ACL for inside-source NAT should identify eligible source addresses, not substitute a destination wildcard.
Question 528
An IOS edge has a configured standard ACL 10 and external pool OUTSIDE. Hosts matching ACL 10 need dynamic one-to-one pool addresses, **not** interface PAT overload. Which NAT mapping command meets this requirement?
- Use ip nat inside source list 10 interface Gi0/1 overload
- Use ip nat inside source static 10.10.1.20 203.0.113.20
- Configure ip nat inside source list 10 pool OUTSIDE
- Use ip nat pool OUTSIDE ... alone without linking ACL 10 to it
Explanation
Correct Answer
C:This NAT statement links the selected internal addresses with the external address pool.
Incorrect Answers
A:That is PAT through a single outside interface address, not dynamic 1:1 use of named pool OUTSIDE.
B:A single static host mapping would not dynamically allocate outside addresses to all hosts selected by ACL 10.
D:Defining a pool is not sufficient; the inside source ACL must be bound to the pool by the mapping rule.
Question 529
LAN hosts in Gi0/0 need NAT when reaching the ISP on Gi0/1. Which direction role must be assigned to the Gi0/0 LAN-facing interface, not the ISP link?
- Apply ip nat outside to Gi0/0 and inside to Gi0/1
- Apply ip nat inside to both Gi0/0 and Gi0/1
- Configure only an inside-source mapping without marking any NAT inside/outside interfaces
- Apply ip nat inside on the internal interface
Explanation
Correct Answer
D:Inside source NAT uses the configured inside/outside interface roles.
Incorrect Answers
A:This reverses the stated trusted LAN versus ISP directions for the inside-source NAT policy.
B:The ISP-facing side must be identified as outside, not another inside interface.
C:The mapping rule alone does not define which routed interfaces participate as NAT inside and outside.
Question 530
A branch router already has inside/outside interface roles and standard ACL 10 matching authorized inside hosts. The WAN interface is GigabitEthernet0/0 with one provider global IPv4 address. Which global IOS command lets multiple inside clients share that interface address using TCP/UDP port translations?
- ip nat inside source list 10 interface GigabitEthernet0/0 overload
- ip nat inside source list 10 pool POOL without overload
- ip nat inside source static 10.1.1.10 203.0.113.10
- no ip nat inside on the LAN interface
Explanation
Correct Answer
A:Inside-source PAT with the `overload` keyword can multiplex multiple inside flows through the WAN interface address using transport-port identifiers.
Incorrect Answers
B:Dynamic pool NAT without overloading assigns global address translations but does not explicitly reuse one interface address with transport-port multiplexing.
C:A static one-to-one mapping binds one inside host to one global address and does not supply generalized PAT for many users.
D:Removing the inside role would prevent normal inside-source NAT for that LAN, not enable shared overload.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests