AP Networking NAT and PAT Troubleshooting Practice Test

1. Source address translation
2. Name resolution
3. Certificate validation
4. Ethernet learning

Correct answer: A. Source address translation

Source NAT changes the address visible beyond the translator. It does not establish server identity or replace routing.

1. Static one-to-one NAT only
2. PAT or NAPT
3. An Ethernet trunk
4. A DNS zone transfer

Correct answer: B. PAT or NAPT

Port translation distinguishes simultaneous transport flows that share a public address. A basic address-only mapping cannot express that distinction by itself.

1. 198.51.100.7:62000
2. 10.0.0.8:51000
3. The client's MAC address as its IP
4. 198.51.100.7:51000 necessarily

Correct answer: A. 198.51.100.7:62000

Read the translated address and port together. PAT may change the source port as well as the source address.

1. A DNS search suffix
2. The client's SSID text
3. The applicable translation state or configured mapping
4. The server's Ethernet broadcast

Correct answer: C. The applicable translation state or configured mapping

The translator needs a matching mapping to recover the internal destination. Receiving a public packet does not itself identify a private endpoint.

1. A DNS label with a MAC address
2. Every user with one password
3. A specific internal address with a specific external address
4. A VLAN with a fiber wavelength

Correct answer: C. A specific internal address with a specific external address

A static address mapping is an address relationship. Policy still determines which traffic may use it.

1. Only a lower routing metric
2. Destination address and port translation to the server
3. Only a larger DHCP pool
4. Only a switch hostname change

Correct answer: B. Destination address and port translation to the server

The incoming destination must be mapped to the internal service tuple. A route to the server alone does not perform that rewrite.

1. Yes; translation creates the application
2. Only when the server is wired
3. Yes; NAT completes TLS automatically
4. No; listener state must be checked separately

Correct answer: D. No; listener state must be checked separately

Translation forwards or rewrites packets according to its configuration. The endpoint must still accept the service and satisfy application requirements.

1. Calculate a subnet mask for every frame
2. Store approved web page titles
3. Associate internal flows with translated outside tuples
4. Issue user certificates

Correct answer: C. Associate internal flows with translated outside tuples

The table supports flow translation and reverse delivery. It is distinct from a resolver cache or routing table.

1. Whether the forwarding target still matches the server
2. Whether every client has a public MAC
3. Whether DNS uses UDP exclusively
4. Whether the subnet mask has become a port

Correct answer: A. Whether the forwarding target still matches the server

A stale target can send traffic to the wrong endpoint. Confirm the current server address and approved mapping before broader changes.

1. All VPN protocols will work
2. Every inbound service is published
3. The edge firewall permits every source
4. The tested exchange traversed the translation path successfully

Correct answer: D. The tested exchange traversed the translation path successfully

Successful outbound delivery demonstrates that particular exchange. It does not establish arbitrary inbound mappings or unrestricted policy.

1. A DNS alias for every TCP port
2. A new private address class
3. A different Ethernet frame type
4. A forwarding path for the translated packet

Correct answer: D. A forwarding path for the translated packet

NAT is not a substitute for routing. The rewritten packet still needs an appropriate next hop.

1. 172.20.4.5
2. 198.51.100.5
3. 8.8.8.8
4. 172.40.4.5

Correct answer: A. 172.20.4.5

The private 172 range is 172.16.0.0 through 172.31.255.255. Not every address beginning with 172 is private.

1. Its TTL must always equal 255
2. Its MAC must be globally routable
3. The forwarding target must remain predictable
4. Its DNS name must contain its subnet

Correct answer: C. The forwarding target must remain predictable

A reservation or approved static assignment keeps the mapping pointed at the intended host. Document the assignment and avoid address conflicts.

1. It turns into an Ethernet broadcast
2. It may no longer be associated with the earlier flow
3. It always reaches the old client
4. It must create a new TLS certificate

Correct answer: B. It may no longer be associated with the earlier flow

State can expire according to the implementation and protocol. Applications relying on continued reachability must account for mapping lifetime.

1. Only the edge device's brand
2. Inside and outside tuples with time and protocol
3. Only the client's wallpaper
4. Only the website's color

Correct answer: B. Inside and outside tuples with time and protocol

A tuple and timestamp connect observations across rewritten paths. Protocol matters because TCP and UDP mappings are not interchangeable.

1. The IP address must be invalid
2. All equal port numbers identify one flow
3. Transport protocol is part of the mapping and policy
4. UDP automatically forwards TCP

Correct answer: C. Transport protocol is part of the mapping and policy

A TCP rule does not inherently create a UDP mapping, or vice versa. Check the protocol named in each configuration.

1. Replace every client's default route
2. Assign Ethernet switch ports
3. Translate application language
4. Rewrite the incoming destination to the internal endpoint

Correct answer: D. Rewrite the incoming destination to the internal endpoint

Destination translation selects the internal address and possibly port. Verify the downstream route and enforcement separately.

1. Only if the public address is static
2. Yes; translated networks need no policy
3. No; access controls and endpoint security remain necessary
4. Yes; private addresses cannot be compromised

Correct answer: C. No; access controls and endpoint security remain necessary

Address translation and authorization solve different problems. A translated network can still allow harmful or unintended communication.

1. NAT loopback or hairpin support under the design
2. A larger Ethernet MTU by definition
3. A second client MAC address
4. A DNS zone transfer on every request

Correct answer: A. NAT loopback or hairpin support under the design

The inside-to-public-to-inside path needs explicit support in many designs. An internal DNS answer can provide a different approved path.

1. A single static route
2. A flat broadcast domain
3. Double NAT
4. A DNS split horizon

Correct answer: C. Double NAT

Two translation boundaries complicate incoming reachability and troubleshooting. Identify both mappings rather than assuming one edge device is the whole path.

1. Carrier-grade NAT
2. A TLS session ticket
3. A local switch mirror
4. A client ARP cache

Correct answer: A. Carrier-grade NAT

Provider translation adds an upstream boundary outside the customer's own edge. Customer port forwarding may not publish a service through it.

1. A green Wi-Fi icon
2. A successful local loopback request
3. Time-matched inside and outside packet tuples or mapping entries
4. A printed topology from last year

Correct answer: C. Time-matched inside and outside packet tuples or mapping entries

Compare the actual packet or state at the relevant time. Local connectivity does not establish what happened at the translator.

1. Yes; DNS installs the router rule
2. Yes; the A record supplies the internal port
3. No; translation and policy must be configured separately
4. Only for HTTPS

Correct answer: C. No; translation and policy must be configured separately

DNS identifies an address. It does not configure the edge mapping, firewall, server listener, or return route.

1. A request from an appropriate external source to the intended service
2. Only a ping from the server to itself
3. Only the router configuration file opening
4. Only checking the server's hostname

Correct answer: A. A request from an appropriate external source to the intended service

External testing exercises the published path. Internal or loopback success can bypass the very translation boundary being repaired.

1. They are automatically assigned by PAT
2. They are reserved for examples rather than real deployment
3. They are the largest private subnet
4. They force every packet to loop back

Correct answer: B. They are reserved for examples rather than real deployment

Documentation ranges let examples avoid real public hosts. They should not be substituted for an actually assigned public address in deployment.

1. 192.0.2.20:443 to 203.0.113.4:61000
2. 10.1.0.9:443 to 192.0.2.20:53000
3. 192.0.2.20:61000 to 203.0.113.4:443
4. 203.0.113.4:53000 to 10.1.0.9:61000

Correct answer: A. 192.0.2.20:443 to 203.0.113.4:61000

The reply reverses the outside request tuple. The translator then recovers the private destination according to the mapping.

1. Distinct usable translated flow identities
2. One DNS answer per application packet
3. The same client MAC on the Internet
4. Identical outside source ports for both flows

Correct answer: A. Distinct usable translated flow identities

The translator must avoid an ambiguous outside tuple. Different translated ports can distinguish otherwise identical simultaneous connections.

1. The service configuration or intended target port
2. Only the public DNS A record
3. Whether the edge saw the SYN at all
4. Only the client's DHCP lease

Correct answer: A. The service configuration or intended target port

The observation already establishes translation and delivery to that endpoint. A listener is a separate missing dependency.

1. Whether no port forward exists anywhere
2. Whether all outside routes are absent
3. Whether the server is entirely powered off
4. Hairpin support and the internal name-resolution design

Correct answer: D. Hairpin support and the internal name-resolution design

Direct internal and external successes narrow the difference to the internal public-address path. Check loopback translation and return behavior rather than republishing blindly.

1. A failure of every local DHCP lease
2. An IPv6 prefix length of 64
3. An upstream shared-address translation boundary
4. A guaranteed globally reachable WAN address

Correct answer: C. An upstream shared-address translation boundary

100.64.0.0/10 is shared address space often used for provider NAT. Confirm the provider's arrangement before assuming local forwarding supplies public reachability.

1. A local DNS cache flush alone
2. A larger internal switch table
3. A supported path through the outer boundary as well
4. A longer browser timeout alone

Correct answer: C. A supported path through the outer boundary as well

The packet must cross both translation/policy boundaries. An inner rule cannot authorize or map traffic that never reaches it.

1. 443 necessarily
2. 53
3. 8443
4. The external client's ephemeral port

Correct answer: C. 8443

Read the post-translation destination tuple. The outside and inside service ports can differ intentionally.

1. That source addresses never change
2. That DNS controls all source ports
3. That the client must have forged a packet
4. The proxy/translation path and trusted attribution mechanism

Correct answer: D. The proxy/translation path and trusted attribution mechanism

An intermediary can become the transport peer visible to the server. Attribution requires knowing the path and validating any forwarded identity metadata.

1. Replace the subnet mask with 53
2. Conclude that all DNS translation is correct
3. Permit only UDP more broadly
4. Inspect protocol-specific mappings and policy for TCP as well

Correct answer: D. Inspect protocol-specific mappings and policy for TCP as well

A successful UDP exchange does not validate TCP. Trace the failed transport independently, including state, route, and policy.

1. Correct the exception's scope and ordering under that implementation
2. Add an unrelated DNS alias
3. Disable all routing
4. Change every server's application password

Correct answer: A. Correct the exception's scope and ordering under that implementation

Evaluation order is implementation-specific and supplied here. Make the intended exemption effective without removing translation required for other destinations.

1. Only server font size
2. Only Ethernet cable color
3. Only the number of Wi-Fi SSIDs
4. Mapping demand, available resources, and creation failures

Correct answer: D. Mapping demand, available resources, and creation failures

Resource exhaustion can stop new mappings while old flows remain alive. Measure demand and failure evidence before choosing capacity or application changes.

1. TCP cannot open new connections by design
2. Every established download bypasses the edge
3. Existing state may remain usable while new allocation fails
4. NAT never maintains state

Correct answer: C. Existing state may remain usable while new allocation fails

A new connection needs usable translation state. Existing state and newly requested state can have different outcomes during exhaustion.

1. Asymmetric return delivery around the translator
2. A DNS typo necessarily
3. A missing browser cache entry
4. An invalid Ethernet cable category by definition

Correct answer: A. Asymmetric return delivery around the translator

Reverse delivery must traverse the correct translation/state context. A reachable outbound next hop alone does not establish that symmetry.

1. Incoming mapping applicability and edge policy at that boundary
2. Only a downstream printer queue
3. Only the internal server's page content
4. Only the client screen resolution

Correct answer: A. Incoming mapping applicability and edge policy at that boundary

The evidence brackets the missing forwarding step at the edge. Examine protocol, destination, interface, mapping, and policy together.

1. Whether each keepalive changes the subnet mask
2. Whether UDP becomes a TCP byte stream
3. Whether the interval and peer behavior fit the actual mapping/filter lifetime
4. Whether DNS TTL equals the NAT lifetime

Correct answer: C. Whether the interval and peer behavior fit the actual mapping/filter lifetime

Mapping and filtering behavior vary. A keepalive plan should be tested against the specific path rather than based on a universal timeout assumption.

1. The post-translation destination, listener, and host policy
2. Only the edge device's hostname
3. Only the client's source MAC
4. Only the public DNS record's TTL

Correct answer: A. The post-translation destination, listener, and host policy

The host evaluates the tuple it actually receives. Internal port rewriting requires corresponding service and host-policy configuration.

1. The local subnet mask
2. The internal server MAC table necessarily
3. Every NAT source port
4. The public name-to-edge address mapping

Correct answer: D. The public name-to-edge address mapping

A correct internal forward cannot help packets sent to an obsolete public address. Compare authoritative/effective DNS with the current assigned edge address.

1. The client's address was public
2. The flow was never translated
3. It does not show whether a mapping existed during the failure
4. The server never replied

Correct answer: C. It does not show whether a mapping existed during the failure

State can expire or be replaced. A later absence cannot establish the past without a time-correlated record.

1. Permit every port to simplify testing
2. Test only internal loopback
3. Confirm only that ping works
4. Confirm the approved web path and denied SSH path from relevant sources

Correct answer: D. Confirm the approved web path and denied SSH path from relevant sources

Narrow publication requires both positive and negative verification. Successful web service alone cannot prove prohibited access stayed blocked.

1. Whether every UDP port should be exposed
2. Whether private addressing is forbidden
3. The VPN's transport, encapsulation, NAT traversal, and exact failure stage
4. Whether web success proves every protocol works

Correct answer: C. The VPN's transport, encapsulation, NAT traversal, and exact failure stage

Different protocols have different translation and policy requirements. Identify the failing exchange and supported traversal design.

1. Time, protocol, peer, sequence context, and the recorded mapping
2. Matching source MAC across routers
3. Matching DNS suffix alone
4. Matching source port alone

Correct answer: A. Time, protocol, peer, sequence context, and the recorded mapping

Addresses and ports may be rewritten. Multiple independent contextual fields avoid joining unrelated flows that merely share a destination.

1. The ACL must be ignored
2. The server application must accept the request
3. A configured address relationship, not permission for that request
4. The outside source is authenticated

Correct answer: C. A configured address relationship, not permission for that request

Translation configuration and authorization can coexist with denial. Evaluate the actual enforcement model and source scope.

1. Assigning a public address to every internal host
2. Eliminating all need for routing
3. Encrypting every DNS query automatically
4. Providing different resolution views for different client contexts

Correct answer: D. Providing different resolution views for different client contexts

Split DNS can support appropriate paths. Maintain consistent service identity and authorized access across both views.

1. Public addresses always identify one person
2. Several users may share that address and mappings change over time
3. A hostname proves physical location
4. Source ports are never translated

Correct answer: B. Several users may share that address and mappings change over time

Shared translation reduces the specificity of an address-only record. Reliable correlation needs the relevant tuple, time, and authoritative mapping records.

1. Change the DNS zone without evidence
2. Declare the application healthy
3. Delete every mapping immediately
4. Trace post-translation delivery and reply rather than assume end-to-end success

Correct answer: D. Trace post-translation delivery and reply rather than assume end-to-end success

A counter establishes a particular processing event. It does not demonstrate listener response, return delivery, or application completion.

1. Replace the inbound mapping because any missing reply means DNAT never occurred
2. Permit more outside source addresses because the reply cannot match a narrow source rule
3. Compare the server's return route and edge-state path before changing inbound publication
4. Extend the translation timeout before examining the observed alternate egress

Correct answer: C. Compare the server's return route and edge-state path before changing inbound publication

Arrival proves the tested inbound mapping worked. The observed reply path lacks the expected reverse context; investigate that boundary rather than widening access.

1. Assume the incoming DNAT entry will rewrite replies that bypass the edge
2. Treat the direct server reply as sufficient because its payload belongs to the request
3. The client can receive a reply from a tuple different from the public peer it contacted
4. Replace the public DNS answer even though the SYN reached the intended server

Correct answer: C. The client can receive a reply from a tuple different from the public peer it contacted

In this stated hairpin design, direct return bypasses reverse translation. The design needs an approved return-path solution, which may include hairpin source translation or direct internal resolution.

1. Clear every active mapping repeatedly instead of measuring creation demand
2. Replace the DNS resolver because established sessions use cached names
3. Translation resource and allocation telemetry correlated with failed creations
4. Increase WAN bandwidth because all new-connection failures imply line saturation

Correct answer: C. Translation resource and allocation telemetry correlated with failed creations

Selective new-state failure with explicit allocation errors supports a translator resource limit. Low utilization does not remove that limit, and capacity changes should address the measured resource.

1. Allow a wider outside source scope while retaining the mismatched internal port
2. Keep the mapping and listener unchanged because public 443 overrides the internal port
3. Move the public A record to the private address to avoid the port difference
4. Align the internal forwarding target with the approved listener or configure the intended approved listener

Correct answer: D. Align the internal forwarding target with the approved listener or configure the intended approved listener

The supplied mismatch is between translated destination and listener. Repair that relationship while retaining the intended source/service restrictions and validating TLS and application behavior.

1. Treat a successful outbound request as proof that public inbound access must work
2. Local forwarding alone cannot guarantee unsolicited public inbound reachability through the upstream boundary
3. Change the internal server port because upstream NAT never affects inbound reachability
4. Repeat the inner forward on additional LAN ports without examining the provider boundary

Correct answer: B. Local forwarding alone cannot guarantee unsolicited public inbound reachability through the upstream boundary

The upstream boundary is outside the local configuration's control. Use an approved provider-supported or mediated access design rather than treating the inner rule as sufficient.

1. The remote server can always recover the private source from the translated IP header
2. The two flows remain distinct outside solely because their private addresses differ
3. Sharing the outside tuple is safe because TCP can infer the client from arrival order
4. The outside flow identity is ambiguous

Correct answer: D. The outside flow identity is ambiguous

With protocol and remote peer also identical, the same translated source tuple cannot distinguish these simultaneous flows. A functioning allocation design must avoid this collision.

1. Assume the mapping still exists because the inside client retains its address
2. Increase DNS TTL because the remote peer's stale transport tuple is a DNS-cache issue
3. Apply a universal timeout value without testing this translator's behavior
4. Measure mapping lifetime and re-establishment behavior with synchronized flow traces

Correct answer: D. Measure mapping lifetime and re-establishment behavior with synchronized flow traces

The timing and stale tuple make mapping expiration a plausible boundary. Measure actual behavior; do not assume one universal timeout or that a keepalive is always an approved remedy.

1. Join the records only by destination port and ignore each observation boundary
2. Use the client public address as the server peer even when the server log contradicts it
3. Treat the two source addresses as proof of spoofing before identifying intermediaries
4. A downstream proxy or further translation boundary

Correct answer: D. A downstream proxy or further translation boundary

The observations describe different boundaries. Account for every intermediary and the actual transport terminator before correlating user identity or diagnosing a source-specific policy.

1. Remove all translation for every destination and verify only the VPN flow
2. Change only the VPN peer's DNS label without examining the translated selector
3. Make the intended exemption effective and verify both private VPN and ordinary Internet paths
4. Keep the exemption later because more specific NAT entries always override first matches

Correct answer: C. Make the intended exemption effective and verify both private VPN and ordinary Internet paths

The stated ordering defeats the intended exception. Test the private path and an unrelated translated path so a VPN repair does not silently break normal egress.

1. Widen outside access controls because that must enable LAN hairpin support
2. Inside hairpin request/return traces and the intended internal DNS view
3. Delete the public mapping because every internal public-address failure implies it is absent
4. Replace the server listener despite success from both direct LAN and cellular paths

Correct answer: B. Inside hairpin request/return traces and the intended internal DNS view

The same public destination is approached through different paths. Compare loopback support, translation, return delivery, and the approved resolution strategy without concluding the external mapping is absent.

1. Declare failover fully transparent because new TCP openings succeed
2. Attribute every reset to the application password without inspecting cluster state
3. Assume the inactive device retains usable old sessions without state synchronization
4. State synchronization and documented session-continuity behavior

Correct answer: D. State synchronization and documented session-continuity behavior

Reachability for newly created state differs from preserving old state. Verify the architecture's actual state-sharing capability and failover expectations rather than promising transparent continuity.

1. Republish every server port because receiving a redirect means the NAT entry is incomplete
2. Disable TLS identity checks because that makes the private redirect reachable
3. Flush client ARP tables because HTTP redirects are link-layer mappings
4. Application publication settings or proxy-aware URL generation

Correct answer: D. Application publication settings or proxy-aware URL generation

The observed HTTP response proves progress beyond initial transport. The redirect advertises an unusable client-facing endpoint; translation alone does not correct application-generated URLs.

1. Match by source port alone even when mappings were rapidly reused
2. Match by public address alone because a translated address always identifies one client
3. Clock alignment and correlation of protocol, peer, mapping interval, and tuple
4. Ignore clock disagreement because the destination service is the same

Correct answer: C. Clock alignment and correlation of protocol, peer, mapping interval, and tuple

Port reuse and timing uncertainty make naive correlation unreliable. Establish consistent time context and the mapping valid during the event.

1. Where the original identity is preserved and where source-based enforcement actually occurs
2. Assume transport source identity survives every DNAT/SNAT/proxy operation
3. Use an original-source host ACL even if that source is absent from the received tuple
4. Treat a proxy source address as proof of the original user's identity

Correct answer: A. Where the original identity is preserved and where source-based enforcement actually occurs

Translation or termination may hide the original transport source from the host. Apply source restrictions at an observation point that sees the required identity, or use an explicitly trusted application mechanism.

1. Delete the client's DNS answer because any missing WAN transmission is name failure
2. Translation state creation does not establish an operational egress path
3. Investigate application credentials before a packet has a working egress path
4. Treat mapping creation as proof that the post-translation route is usable

Correct answer: B. Translation state creation does not establish an operational egress path

A processing event and a usable forwarding path are separate. Use the effective route and next-hop evidence to locate the blocked stage.

1. Conclude the local listener is absent even though the original peer succeeds
2. Assume UDP mappings have identical peer behavior on all translators
3. The translator's mapping and filtering behavior for different remote peers
4. Assume an existing public tuple accepts every remote peer without filtering

Correct answer: C. The translator's mapping and filtering behavior for different remote peers

An existing mapping does not imply unrestricted peer acceptance. Behavior depends on implementation and configuration; inspect supported mapping/filter semantics and compare actual peers.

1. Reconfigure the first mapping even though its packet was observed at the second router
2. The inner translated service tuple
3. Widen the external source range instead of correcting the inner destination port
4. Replace public DNS despite arrival at the correct outer and inner edges

Correct answer: B. The inner translated service tuple

The first boundary has demonstrated progress. Repair the inner tuple identified by the trace, then verify the complete request and return paths through both boundaries.

1. New destination delivery and reverse translation along the intended path
2. Verify only a router-originated local ping to the new private address
3. Accept the new target text as complete repair without tracing the response
4. Reuse the old response-route assumption despite the server segment move

Correct answer: A. New destination delivery and reverse translation along the intended path

Moving an endpoint can change both forward and reverse dependencies. A correct destination rule does not establish the response route or applicable state.

1. Increase all quotas immediately without determining the demand or failing allocation resource
2. Classify the host as malicious solely from the mapping count
3. Identify that host's approved workload or fault and correlate resource pressure before changing quotas
4. Blame WAN bandwidth without comparing utilization and translation failures

Correct answer: C. Identify that host's approved workload or fault and correlate resource pressure before changing quotas

The outlier is an investigation lead, not a diagnosis by itself. Attribute the demand and allocation failures, then choose a proportionate repair consistent with legitimate requirements.

1. Treat any valid certificate as proof of the requested hostname
2. Conclude initial TCP translation failed despite receiving the certificate
3. Service binding, hostname/SNI handling, and configured application identity
4. Change the client default gateway before comparing SNI and service binding

Correct answer: C. Service binding, hostname/SNI handling, and configured application identity

Successful transport and a presented certificate move diagnosis to service selection and identity. NAT can reach an endpoint that serves the wrong hostname.

1. Header translation does not necessarily rewrite application payload references
2. Publish more transport ports without checking the address the peer was told to use
3. Treat successful header rewriting as proof of all follow-on application paths
4. Assume basic NAT rewrites every embedded application address automatically

Correct answer: A. Header translation does not necessarily rewrite application payload references

Application protocols may advertise separate connection information. Use a supported publication/traversal design; do not assume basic NAT understands or can modify every payload.

1. Assume the local management listener cannot interact with inbound forwarding behavior
2. Create a second forward for the same tuple and assume the router chooses the intended host
3. Change only internal DNS while leaving the public tuple ownership conflict unresolved
4. The platform's local-service versus forwarding behavior and intended ownership of that tuple

Correct answer: D. The platform's local-service versus forwarding behavior and intended ownership of that tuple

A public tuple cannot be assigned blindly to conflicting functions. Check the platform's actual precedence and separate or disable the appropriate service under the approved design.

1. The remote source allowlist and approved alternate egress identity
2. Assume remote source restrictions remain satisfied whenever a backup route exists
3. Change the client private subnet because remote policy uses the public source
4. Keep only the primary public address allowlisted and verify failover with ping

Correct answer: A. The remote source allowlist and approved alternate egress identity

A backup route can restore reachability while changing the translated identity. Security dependencies need explicit failover planning and verification.

1. Merge both sites into one broadcast domain without a deliberate scope and policy plan
2. The overlapping address spaces can make endpoint destinations ambiguous without a deliberate addressing/translation design
3. Assume a standard route unambiguously selects the remote site despite local overlap
4. Treat the VPN tunnel as automatically renumbering every embedded private address

Correct answer: B. The overlapping address spaces can make endpoint destinations ambiguous without a deliberate addressing/translation design

A destination may appear local when it refers to the remote site. Plan renumbering or supported translation with clear routes, policy, and application implications rather than treating overlap as a harmless label.

1. Save only a screenshot of the public address without time or protocol
2. The approved outside/inside tuples, source scope, dependencies, test evidence, and rollback plan
3. Record only that HTTPS worked, omitting the inside port and retained access restriction
4. Document the new permit but omit the response path and prohibited-access test

Correct answer: B. The approved outside/inside tuples, source scope, dependencies, test evidence, and rollback plan

Documentation must capture both the intended publication and the retained boundary. Tuple, route, ownership, and verification details let the next technician assess later failures without guessing.