A cooperative's back-office workstations use private 10.x addresses internally, but a technician notices that when one of those workstations reaches a public website, the site's server sees a completely different, publicly routable source address in the arriving packets. Which function performed this address change?

Network address translation rewrites the source (and sometimes destination) IP address field as a packet crosses a translating device, commonly swapping a private RFC 1918 address for a publicly routable one so the packet can traverse the internet and so return traffic can find its way back to the originating internal host. This is exactly the behavior described: the workstation's own private address never appears on the internet-facing side, because the translating router replaced it in transit. ARP resolves a known IP address to a local MAC address on the same segment; it never rewrites an IP header field and has no role once a packet leaves the local subnet. VLAN tagging adds an 802.1Q tag to separate broadcast domains at Layer 2 and doesn't touch Layer 3 addressing at all, so it can't explain a changed source IP. DHCP assigns an address to a host at lease time but plays no part in translating that address later as traffic actually transits a router. A caveat worth noting is that NAT breaks the assumption that a packet's source address at the destination always matches what the sender configured, which is why some protocols that embed IP addresses inside their payload need special handling to work through it. An operational check is reviewing the translation table on the router performing NAT to confirm the private-to-public mapping for that workstation actually exists.