N10-009 Question 147
Single answerAddress translation: NAT, Port address translation (PAT)A small company has 120 internal workstations using private IPv4 addresses. The ISP has provided only one public IPv4 address for the office firewall. Users report that all PCs can browse the web and access cloud services successfully, but the company cannot assign a unique public IP to each workstation. The network administrator needs a solution that allows many internal hosts to access the internet simultaneously through that single public IP. Which technology should the administrator configure on the firewall?
- A
Static NAT with a one-to-one mapping for each internal workstation
- B
Port Address Translation (PAT) using many-to-one translation
- C
A default route pointing all traffic to the ISP gateway
- D
Split-horizon DNS to return different addresses for internal and external users
Show answer and explanation
Correct answer: B
Explanation
The best answer is Port Address Translation (PAT). PAT is a form of NAT that maps many private internal addresses to one public IPv4 address by using different source port numbers for each session. This is commonly called many-to-one NAT or NAT overload. It is widely used on firewalls and routers in small and medium-sized networks because public IPv4 addresses are limited. Static NAT would require one public IP per internal host, which the company does not have. A default route is required for internet connectivity but does not replace translation. Split-horizon DNS addresses name resolution behavior, not address translation. This aligns with standard networking practice and the use of private IPv4 address space defined in RFC 1918, which requires translation for internet access.
- A. Incorrect.
Incorrect. Static NAT creates a one-to-one mapping between a private IP and a public IP. That is useful when a specific internal device, such as a server, must be reachable with a consistent public address. In this scenario, the company has only one public IP and 120 workstations, so one-to-one mappings are not possible for all clients.
- B. Correct.
Correct. PAT, also called NAT overload, allows multiple internal hosts to share a single public IPv4 address by translating both the source IP address and the source port number. The firewall tracks each session with unique port mappings, which enables many users to access external resources at the same time through one public IP. This is the standard approach for small offices with many private hosts and limited public IPv4 space.
- C. Incorrect.
Incorrect. A default route is necessary for forwarding traffic toward the ISP, but it does not perform address translation. Without NAT or PAT, private RFC 1918 addresses are not routable on the public internet, so users would not be able to communicate externally just by adding a default route.
- D. Incorrect.
Incorrect. Split-horizon DNS is a DNS design technique that returns different DNS responses depending on where the client is located. It does not translate private addresses to public ones and does not solve the problem of multiple clients sharing a single public IPv4 address for outbound internet access.