Pass the Cisco CCNP Enterprise 350-401 Questions and answers with CertsForce

The inside user subnet is 192.168.1.0/24, which supports 254 usable host addresses. The configured NAT pool only provides addresses from 10.10.10.1 through 10.10.10.100, giving 100 usable translated addresses. Dynamic NAT without overload requires a sufficient number of inside global addresses if all users must be translated at the same time. Therefore, to support all users continuously, the NAT pool must be increased to support the 254 usable inside hosts. Option C is the best answer. Option A, match-host, is not the correct fix for the pool-size shortage; it is used for host-number matching behavior and still requires a usable pool design. Option B is wrong because NAT should translate private inside addresses to a different inside global address range, not reuse the same inside local subnet. Option D describes static one-to-one behavior and does not match the dynamic NAT route-map configuration shown. The key technical issue is address pool capacity. References/topics: ENCOR Infrastructure, NAT, dynamic NAT, inside local and inside global addresses, NAT pools, route-map-based NAT.

The correct answer is B. Only the database can initiate communication.

From the exhibit:

ip nat inside source static 10.1.2.100 interface GigabitEthernet0/1

Inside local (DB): 10.1.2.100

Inside global (translated IP): 10.50.250.1 (Gi0/1 interface)

NAT type: Static NAT

Static NAT creates a permanent one-to-one mapping between inside local and inside global IP.

It allows bidirectional communication, but only if traffic is properly addressed.

The server initiates the connection

The server expects the DB to appear as 10.50.250.0/24 (translated network)

The server sends traffic to 10.50.250.1 (inside global IP).

The router translates:

Destination → 10.1.2.100 (DB) ✔️

DB receives the request and responds.

Return traffic is translated back to 10.50.250.1 ✔️

However:

The NAT rule only defines source translation for traffic originating from inside (DB).

It does not fully support proper session handling when initiated from outside unless routing/NAT symmetry is correct.

In this topology, the expectation and flow mismatch causes only inside-initiated sessions to work reliably.

The database (inside) can initiate connections outward using NAT ✔️

The server (outside) initiating may fail due to NAT direction and expectation mismatch ❌

A. Only the server can initiate communication Incorrect — NAT favors inside-initiated traffic.

C. No communication possible Incorrect — inside-initiated traffic still works.

D. Both can initiate communication Incorrect — would only be true with correct bidirectional NAT design.

Static NAT = bidirectional mapping, BUT

Always check:

Who initiates traffic

Which side is inside vs outside

Whether NAT rules match expected traffic flow

Exam trick:

If NAT is configured as inside source , it primarily supports inside → outside initiation.

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr