300-410 IPv6 Traffic Filtering and uRPF — All Questions With Answers

A network engineer is troubleshooting a connectivity issue between two routers R1 and R2 connected via GigabitEthernet0/0. The engineer notices that R1 can ping its own IPv6 address 2001:db8:1::1/64, but cannot ping R2's interface address 2001:db8:1::2/64. The output of 'show ipv6 interface GigabitEthernet0/0' on R1 indicates that IPv6 is enabled and the interface is up/up. The engineer checks the access list applied to the interface and sees an inbound IPv6 ACL that permits only ICMPv6 echo requests from a specific source. What is the most likely cause of the ping failure?

Question 2hardmultiple choice

A network engineer is troubleshooting a BGP IPv6 peering issue between two routers, R1 and R2, connected via a point-to-point link. The engineer notices that the BGP session is flapping with error 'BGP Notification sent: 3/2 (Update malformed)'. The engineer checks the IPv6 ACL applied to the interface on R1 and sees an inbound ACL that permits only TCP port 179 from the neighbor's link-local address. The BGP peering uses the global unicast addresses of the interfaces. What is the most likely cause of the BGP session failure?

Question 3mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is troubleshooting an IPv6 routing issue on a router that is receiving OSPFv3 routes from multiple neighbors. The engineer notices that some routes are missing from the routing table. The engineer checks the interface configuration and finds an inbound IPv6 ACL applied to the interface that permits only specific prefixes. The engineer also notices that the missing routes are from a neighbor that is sending routes with a prefix length of /48, while the ACL permits only /64 prefixes. What is the most likely cause of the missing routes?

Question 4hardmultiple choice

A network engineer is troubleshooting a connectivity issue where a host on VLAN 10 cannot reach a server on VLAN 20. Both VLANs are on the same switch, which is running IPv6. The engineer checks the switch and finds that uRPF (unicast Reverse Path Forwarding) is enabled in strict mode on the VLAN 20 interface. The host's IPv6 address is 2001:db8:10::100/64, and the server's address is 2001:db8:20::200/64. The switch has a default route pointing to a next-hop router. The host sends traffic to the server, but the switch drops the packets. What is the most likely cause?

Question 5mediummultiple choice

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

Question 6mediummultiple choice

A network engineer is troubleshooting a scenario where a router is dropping IPv6 packets that are destined for a server on a directly connected network. The engineer checks the interface and finds that uRPF is enabled in loose mode. The router has a default route pointing to an upstream router. The source address of the packets is 2001:db8:100::1, which is not in the routing table (the router has no route to that prefix). What is the most likely cause of the packet drops?

Question 7hardmultiple choice

A network engineer is troubleshooting an IPv6 multicast issue on a router. The router is receiving multicast traffic from a source, but the traffic is not being forwarded to downstream receivers. The engineer checks the interface and finds an inbound IPv6 ACL that permits only certain multicast groups. The ACL permits the group address FF1E::1, but the source address is 2001:db8:1::1. The engineer also notices that uRPF is enabled on the interface in strict mode. The router has a route to the source's network via a different interface. What is the most likely cause of the multicast forwarding failure?

Question 8hardmultiple choice

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is using a tunnel interface (IPv6 over IPv4). The engineer notices that traffic is not passing through the tunnel. The engineer checks the tunnel interface and finds an inbound IPv6 ACL that permits only certain IPv6 traffic. The engineer also sees that uRPF is enabled on the tunnel interface in strict mode. The tunnel source and destination are IPv4 addresses. The IPv6 traffic sourced from a network behind the tunnel is being dropped. What is the most likely cause?

Question 9easymultiple choice

A network engineer is troubleshooting an IPv6 routing issue where a router is not learning routes from an OSPFv3 neighbor. The engineer checks the interface and finds an inbound IPv6 ACL that permits only OSPFv3 packets with a specific area ID in the packet. The ACL is using the 'ospfv3' keyword to match packets. The engineer also notices that the OSPFv3 neighbor is in a different area. What is the most likely cause of the route learning failure?

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0

GigabitEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64 Joined group address(es): FF02::1 FF02::2 ICMP redirects are enabled ICMP unreachables are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 1000 milliseconds ND router advertisements are sent every 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses. IPv6 uRPF: strict mode (drop invalid packets)

Based on this output, what is the operational state of uRPF on this interface?

Question 11mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 interface tunnel 0

Tunnel0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:2::1, subnet is 2001:DB8:2::/64 Joined group address(es): FF02::1 FF02::2 ICMP redirects are enabled ICMP unreachables are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds IPv6 uRPF: loose mode (allow default route)

Based on this output, what is the uRPF configuration on this interface?

Question 12easymultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list FILTER-IPv6

IPv6 access list FILTER-IPv6

permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 any any sequence 20

Based on this output, what is the effect of this access list when applied to an interface?

Question 13mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF

IPv6 uRPF: strict mode

Based on this output, which statement is true?

Question 14mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF

IPv6 uRPF: loose mode

Based on this output, what is the operational state of uRPF on this interface?

Question 15easymultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list DENY-REMOTE

IPv6 access list DENY-REMOTE

deny ipv6 2001:DB8:2::/48 any sequence 10
    permit ipv6 any any sequence 20

Based on this output, what is the effect of this access list when applied to an interface?

Question 16mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF

IPv6 uRPF: strict mode (allow default route)

Based on this output, what is the uRPF configuration on this interface?

Question 17hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0

Based on this output, which two features are configured on this interface?

Question 18mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list PERMIT-ONLY

IPv6 access list PERMIT-ONLY

permit ipv6 2001:DB8:3::/48 any sequence 10

Based on this output, what is the effect of this access list when applied to an interface?

Question 19mediummultiple choice

Examine the following IPv6 ACL applied to an interface:

ipv6 access-list FILTER

permit ipv6 any any fragments
 deny ipv6 any any

interface GigabitEthernet0/1

ipv6 traffic-filter FILTER in

What is the effect of this configuration?

Question 20mediummultiple choice

Consider the following configuration:

ipv6 access-list BLOCK-ICMP

deny icmp any any echo-request
 deny icmp any any echo-reply
 permit ipv6 any any

interface GigabitEthernet0/2

ipv6 traffic-filter BLOCK-ICMP in

Which statement is true?

Question 21mediummultiple choice

Review the following configuration:

ipv6 access-list FILTER

permit tcp 2001:db8:1::/48 any eq 80
 permit tcp 2001:db8:1::/48 any eq

443

deny ipv6 any any

interface GigabitEthernet0/3

ipv6 traffic-filter FILTER out

What is the effect of this configuration?

Question 22mediummultiple choice

Examine this configuration:

interface GigabitEthernet0/4

ipv6 address 2001:db8:2::1/64 ipv6 verify unicast source reachable-via any

What is the effect of the 'ipv6 verify unicast source reachable-via any' command?

Question 23mediummultiple choice

Consider the following configuration:

ipv6 access-list FILTER

permit ipv6 2001:db8:3::/48 any
 deny ipv6 any any

interface GigabitEthernet0/5

ipv6 traffic-filter FILTER in ipv6 verify unicast source reachable-via rx

A packet arrives on GigabitEthernet0/5 with source 2001:db8:3::100 and destination 2001:db8:4::1. The route for 2001:db8:3::/48 points out interface GigabitEthernet0/6. What happens?

Question 24mediummultiple choice

Review this configuration:

route-map RMAP permit 10 match ipv6 address prefix-list PREFIX set interface null0 ! ipv6 prefix-list PREFIX seq 5 permit 2001:db8:5::/48 !

interface GigabitEthernet0/6

ipv6 verify unicast source reachable-via any allow-default

What is the purpose of the 'allow-default' keyword?

Question 25easymultiple choice

In IPv6, what is the default action for an access-list entry that does not specify a protocol?

Question 26easymultiple choice

What is the default uRPF mode when 'ipv6 verify unicast source reachable-via' is configured without any keyword?

Question 27mediummultiple choice

According to RFC 2460, what is the correct behavior when an IPv6 router receives a packet with a source address that is a multicast address?

Question 28mediummulti select

Which TWO commands can be used to verify IPv6 unicast RPF operation on an interface? (Choose TWO.)

Question 29mediummulti select

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

Question 30hardmulti select

Which THREE symptoms indicate that IPv6 unicast RPF is misconfigured or failing on an interface? (Choose THREE.)

Question 31mediummulti select

Which TWO configuration steps are required to implement IPv6 traffic filtering using a named ACL on a Cisco router? (Choose TWO.)

Question 32hardmulti select

Which THREE statements about IPv6 unicast RPF (uRPF) are true? (Choose THREE.)

Question 33hardmultiple choice

A large enterprise network uses OSPFv3 for IPv6 routing. Router R1 and R2 are connected via a multi-access Ethernet link. R1 is configured with 'ipv6 ospf network point-to-point' while R2 uses the default broadcast network type. R1 has an IPv6 ACL applied inbound on its interface that permits only OSPF (89) and denies all other traffic. R2 is unable to form a full OSPF adjacency with R1. R2 shows 'OSPFv3 adjacency state is EXSTART/EXCHANGE' and logs 'Bad LSReq'. What is the root cause?

Question 34hardmultiple choice

An enterprise uses EIGRP for IPv6 with route summarization. Router R1 has a summary route 2001:db8:1::/48 via Null0 redistributed into EIGRP. Router R2 receives this summary and has a more specific route 2001:db8:1:1::/64 learned via a different interface. R2's IPv6 uRPF is configured in strict mode on the interface facing R1. Traffic from a host behind R2 destined to 2001:db8:1:2::1 is being dropped. R2 shows 'ipv6 cef' indicates the summary route points to R1, but uRPF checks fail. What is the root cause?

Question 35hardmultiple choice

Read the full MPLS explanation →

A DMVPN network uses IPv6 with EIGRP as the routing protocol. Spoke routers R2 and R3 are behind NAT and use mGRE tunnels. The hub R1 has an IPv6 ACL applied inbound on the tunnel interface that permits only EIGRP and denies all other IPv6 traffic. Spoke-to-spoke traffic fails even though direct tunnels are established. R2 shows 'ping 2001:db8:3::1 source loopback0' fails, but 'ping 2001:db8:1::1' (hub) succeeds. What is the root cause?

Question 36hardmultiple choice

An MPLS network uses LDP for label distribution with IPv6. Router R1 and R2 are LDP peers. R1 has an IPv6 ACL applied inbound on the interface facing R2 that permits only TCP port 646 (LDP) and denies all other traffic. R2 shows 'show mpls ldp neighbor' indicates the neighbor is up, but 'show mpls forwarding-table' shows no labels for IPv6 prefixes. R1's 'show mpls ldp bindings' shows labels for all prefixes. What is the root cause?

Question 37hardmultiple choice

A dual-stack network uses BGP for IPv6 between AS 100 and AS 200. Router R1 (AS 100) has an inbound route-map that sets local preference to 200 for routes from R2 (AS 200). R1 also has an IPv6 ACL applied inbound that permits only BGP (TCP 179) and denies ICMPv6. R2 advertises a prefix 2001:db8:1::/48. R1's BGP table shows the prefix with local preference 200, but 'show ipv6 route' does not install it. R1 has uRPF strict mode on the interface facing R2. What is the root cause?

Question 38hardmultiple choice

An enterprise uses VRF-lite with IPv6. VRF A on R1 leaks routes to VRF B using route-target import/export. R1 has an IPv6 ACL applied inbound on the interface in VRF A that permits only OSPFv3 and denies all other traffic. R1's VRF B has a static default route pointing to a next-hop in VRF A. Traffic from VRF B to the internet fails. R1 shows 'ping vrf B 2001:db8:2::1' fails, but 'ping vrf A 2001:db8:2::1' succeeds. What is the root cause?

Question 39hardmultiple choice

An OSPFv3 network has multiple areas. Area 0 includes R1 and R2. Area 1 includes R2 and R3. R2 is an ABR. R1 has an IPv6 ACL applied inbound on the interface to R2 that permits only OSPFv3 and denies all other traffic. R3 advertises a prefix 2001:db8:3::/48 into Area 1. R1's routing table shows the prefix but with a next-hop of R2. R1's uRPF is configured in strict mode on the interface to R2. Traffic from R1 to 2001:db8:3::1 is dropped. R1 shows 'show ipv6 cef 2001:db8:3::/48' points to R2's link-local address. What is the root cause?

Question 40hardmultiple choice

An enterprise uses EIGRP for IPv6 with route redistribution from a static route. R1 has a static route 2001:db8:0::/32 via Null0 redistributed into EIGRP. R2 receives this route and has a more specific route 2001:db8:1::/32 via a different interface. R2 has an IPv6 ACL applied inbound on the interface facing R1 that permits only EIGRP and denies all other traffic. R2's uRPF is configured in loose mode. Traffic from R2 to 2001:db8:2::1 fails. R2 shows 'show ipv6 route' has both routes, but 'show ipv6 cef' shows the summary route for 2001:db8:2::1 pointing to R1. What is the root cause?

Question 41hardmultiple choice

A dual-stack network uses BGP for IPv6 between two ISPs. R1 (AS 100) receives a full BGP table from R2 (AS 200). R1 has an IPv6 ACL applied inbound on the interface to R2 that permits only BGP (TCP 179) and denies all other traffic. R1 also has uRPF configured in strict mode on the same interface. R1's BGP table has a route to 2001:db8:1::/48 with next-hop 2001:db8:2::2. R1's routing table shows the route, but traffic from R1 to 2001:db8:1::1 fails. R1 shows 'show ipv6 cef 2001:db8:1::/48' points to 2001:db8:2::2 via the interface to R2. What is the root cause?

Question 42mediummultiple choice

A network engineer runs the following command to troubleshoot an IPv6 traffic filtering issue:

R1# show ipv6 access-list FILTER

IPv6 access list FILTER

permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 2001:DB8:2::/48 any sequence

permit ipv6 any any sequence 30

What does this output indicate?

Question 43mediummultiple choice

A network engineer runs the following command to verify IPv6 uRPF operation:

R1# show ipv6 interface GigabitEthernet0/0 | include verify

IPv6 verify source: strict

What does this output indicate?

Question 44hardmultiple choice

A network engineer runs the following command to debug IPv6 traffic filtering:

R1# debug ipv6 packet access-list FILTER detail

IPv6 packet debugging is on for access list FILTER (detail)

*Mar 1 00:01:23.456: IPv6: source 2001:DB8:2::1 (GigabitEthernet0/0)
*Mar 1 00:01:23.456:   dest 2001:DB8:3::1 (GigabitEthernet0/1)
*Mar 1 00:01:23.456:   traffic class 0, flowlabel 0, hlim 64, next header 6 (TCP)
*Mar 1 00:01:23.456:   denied by access-list FILTER

What does this output indicate?

Question 45mediummultiple choice

A network engineer runs the following command to verify IPv6 uRPF drops:

R1# show ipv6 traffic | include verify

0 verify source drops, 0 verify source suppressed drops

What does this output indicate?

Question 46hardmultiple choice

A network engineer runs the following command to debug IPv6 uRPF:

R1# debug ipv6 verify

IPv6 verify debugging is on

*Mar 1 00:02:34.567: IPv6 verify: source 2001:DB8:4::1 on GigabitEthernet0/0
*Mar 1 00:02:34.567:   no route to source

What does this output indicate?

Question 47mediummultiple choice

A network engineer runs the following command to verify IPv6 access-list hits:

R1# show ipv6 access-list FILTER | include matches
    permit ipv6 2001:DB8:1::/48 any sequence 10 (10 matches)
    deny ipv6 2001:DB8:2::/48 any sequence 20 (5 matches)
    permit ipv6 any any sequence 30 (100 matches)

What does this output indicate?

Question 48mediummultiple choice

A network engineer runs the following command to verify IPv6 uRPF on an interface:

R1# show ipv6 interface GigabitEthernet0/0 | include verify|suppress

IPv6 verify source: strict IPv6 verify source suppress: disabled

What does this output indicate?

Question 49hardmultiple choice

A network engineer runs the following command to debug IPv6 uRPF with detailed information:

R1# debug ipv6 verify detail

IPv6 verify debugging is on (detail)

*Mar 1 00:03:45.678: IPv6 verify: source 2001:DB8:5::1 on GigabitEthernet0/0
*Mar 1 00:03:45.678:   route to source via GigabitEthernet0/1, not same as input interface

What does this output indicate?

Question 50mediummultiple choice

A network engineer runs the following command to verify IPv6 traffic filtering with logging:

R1# show logging | include FILTER
*Mar 1 00:04:56.789: %IPV6_ACL-6-ACCESSLOGDP: list FILTER denied tcp 2001:DB8:2::1(12345) -> 2001:DB8:3::1(80), 1 packet

What does this output indicate?

Question 51easymultiple choice

What is the default administrative distance for IPv6 static routes in Cisco IOS-XE?

Question 52mediummultiple choice

Which statement correctly describes the behavior of IPv6 Unicast Reverse Path Forwarding (uRPF) in strict mode?

Question 53easymultiple choice

What is the default hello interval for OSPFv3 on a broadcast network type in Cisco IOS-XE?

Question 54mediummultiple choice

Which IPv6 access-list entry will deny traffic from any source to the destination prefix 2001:db8:1::/48?

Question 55hardmultiple choice

What is the default metric for an IPv6 static route redistributed into OSPFv3?

Question 56mediummultiple choice

Which statement about IPv6 uRPF loose mode is true?

Question 57hardmultiple choice

What is the default dead interval multiplier for OSPFv3?

Question 58hardmultiple choice

Which IPv6 traffic filter can be used to match traffic based on the Flow Label field?

Question 59easymultiple choice

What is the default administrative distance for OSPFv3 internal routes?

Question 60mediumdrag order

Drag and drop the steps to configure uRPF in strict mode on an edge router into the correct order, from first to last.

Question 61harddrag order

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

Question 62mediumdrag order

Drag and drop the steps to verify and validate IPv6 traffic filtering and uRPF operational state into the correct order, from first to last.

Question 63hardmulti select

Which TWO statements about IPv6 unicast RPF (uRPF) behavior in Cisco IOS-XE are correct? (Choose TWO.)

Question 64hardmulti select

Which TWO configuration changes will prevent IPv6 traffic from being forwarded from a specific source prefix in a BGP environment without using a prefix list? (Choose TWO.)

Question 65hardmulti select

Which THREE commands can be used to verify IPv6 traffic filtering and uRPF operation on a Cisco IOS-XE router? (Choose THREE.)

Question 66hardmulti select

Which TWO statements about the interaction between IPv6 ACLs and uRPF are correct? (Choose TWO.)

Question 67hardmulti select

Which TWO actions will prevent IPv6 traffic with a spoofed source address from being forwarded in a network where BGP is used for routing? (Choose TWO.)

Question 68hardmultiple choice

An engineer configures IPv6 uRPF strict mode on an interface of a router that participates in OSPFv3. The router starts dropping OSPFv3 Hello packets received on that interface, causing the OSPFv3 neighbor adjacency to fail. Which is the most likely explanation?

Question 69hardmultiple choice

An engineer configures an IPv6 ACL to filter OSPFv3 traffic on a router interface. The ACL includes a deny entry for OSPFv3 (protocol 89) followed by a permit ipv6 any any. However, OSPFv3 adjacencies still fail to form over that interface. Which is the most likely explanation?

Question 70hardmultiple choice

An engineer configures IPv6 uRPF loose mode on an interface that connects to a DMVPN spoke. The spoke router uses NHRP to register with the hub and establishes a tunnel. Traffic from the spoke to destinations behind the hub is dropped. Which is the most likely explanation?

Question 71hardmultiple choice

An engineer configures an IPv6 ACL on a router interface to permit only specific ICMPv6 types (e.g., echo request and echo reply) and deny all other IPv6 traffic. After applying the ACL inbound, the router stops forming IPv6 neighbor discoveries (ND) and the interface loses IPv6 connectivity. Which is the most likely explanation?

Question 72hardmultiple choice

Open the full VLAN trunking answer →

An engineer configures uRPF strict mode on an interface that is part of an IPv6 BGP multihoming setup with two upstream providers. The router receives BGP routes from both providers and has equal-cost paths to some destinations. Traffic from the router to those destinations is intermittently dropped. Which is the most likely explanation?

Question 73hardmultiple choice

An engineer applies an IPv6 ACL to filter traffic between two VLANs on a switch using a router-on-a-stick configuration. The ACL is applied inbound on the subinterface. Traffic from VLAN 10 to VLAN 20 is permitted, but return traffic from VLAN 20 to VLAN 10 is dropped. Which is the most likely explanation?

Question 74hardmultiple choice

An engineer configures IPv6 uRPF strict mode on an interface that is used for both IPv6 traffic and OSPFv3 routing. The router is an ABR with multiple areas. OSPFv3 adjacencies form correctly, but some IPv6 data traffic is dropped. The show ipv6 interface command shows uRPF is enabled. Which is the most likely explanation?

Question 75hardmultiple choice

An engineer configures an IPv6 ACL to permit BGP traffic (TCP port 179) between two routers and deny all other traffic. The ACL is applied inbound on the interface facing the BGP neighbor. BGP session establishes, but the routers cannot exchange IPv6 routes. Which is the most likely explanation?

Question 76hardmultiple choice