050-696 · Question #163
Which firewall technology translates private IP addresses into registered IP addresses, reducing the total number of registered IP addresses required on your network?
The correct answer is D. Network Address Translation. NAT maps private internal IP addresses to a smaller set of registered public IP addresses, allowing many internal hosts to share fewer public IPs. It is the standard mechanism for conserving registered address space at a network boundary.
Question
Options
- AApplication Proxy
- BVirtual Private Network
- CPacket-Filtering Firewall
- DNetwork Address Translation
How the community answered
(32 responses)- A13% (4)
- B6% (2)
- C3% (1)
- D78% (25)
Why each option
NAT maps private internal IP addresses to a smaller set of registered public IP addresses, allowing many internal hosts to share fewer public IPs. It is the standard mechanism for conserving registered address space at a network boundary.
An application proxy forwards client requests at the application layer on behalf of users but does not translate IP addresses between private and public address spaces.
A VPN creates an encrypted tunnel between endpoints for secure remote communication but does not reduce the number of registered public IP addresses an organization must obtain.
A packet-filtering firewall evaluates packets against access control rules to permit or deny traffic but performs no IP address translation.
Network Address Translation rewrites IP packet headers as traffic passes through a router or firewall, substituting private RFC 1918 addresses with registered public IP addresses. This many-to-one or many-to-few mapping allows an entire organization to use only one or a handful of public IPs regardless of internal host count. Because NAT operates at the network layer and directly manipulates source and destination addresses, it is the precise technology described in the question.
Concept tested: Network Address Translation purpose and address conservation
Source: https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/26704-nat-faq-00.html
Topics
Community Discussion
4
Ola B.Jun 11, 2026Network Address Translation is the correct answer here. NAT sits at the edge of your network and swaps out your internal private addresses (the RFC 1918 ranges like 192.168.x.x or 10.x.x.x) for one or a small pool of registered public addresses before packets go out to the internet, which is exactly what lets a company run hundreds of internal hosts behind just a handful of public IPs. The other options do not do address translation: a packet-filtering firewall just allows or drops traffic based on headers, an application proxy acts as a go-between at Layer 7, and a VPN creates an encrypted tunnel but does not remap addresses the way NAT does. Spin up a home router lab or even a GNS3 topology and watch the NAT translation table fill up as devices go out, it makes this concept click immediately.
Wesley A.Jun 12, 2026PAT (Port Address Translation) is the specific flavor most orgs actually run since it maps thousands of internal hosts to a single public IP using port numbers, so knowing that distinction saved me a point on my retake when the question wording got picky about it.
Tatiana S.Jun 17, 2026Glancing at this I almost circled A, Application Proxy, because proxies do sit between inside hosts and the outside and they rewrite connection headers, so there is a surface-level resemblance to what the question is describing. But an application proxy is doing that work at the application layer for content inspection and access control, not for the purpose of conserving registered address space. The question is specifically about translating private RFC 1918 addresses to one or a pool of registered public addresses, and that is NAT doing exactly what it was designed to do, mapping many inside private addresses through a smaller set of routable ones. D is the only answer that fits the definition cleanly.
Wesley A.May 29, 2026D is the one, no question. NAT sits at the boundary of your network and swaps internal RFC 1918 addresses (like 192.168.x.x) for one or more public registered IPs on the way out, so your entire private subnet can share a handful of real addresses instead of needing one per device.