300-410 IPv6 Traffic Filtering and uRPF Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF
  IPv6 uRPF: strict mode (allow default route)

Based on this output, what is the uRPF configuration on this interface?

Accepted Answer

uRPF is enabled in strict mode with allow-default. The command output explicitly shows 'IPv6 uRPF: strict mode (allow default route)', which confirms that uRPF is enabled in strict mode with the allow-default option. This configuration validates that the source address of incoming packets must have a matching route in the FIB pointing back to the same interface, and the allow-default keyword permits the use of a default route as a valid reverse path, which is necessary in scenarios where a default route is the only route to the source.

Answer

uRPF is disabled

Answer

uRPF is enabled in loose mode

Answer

uRPF is enabled but only for multicast

Question 2

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  Global unicast address(es):
    2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64
  Joined group address(es):
    FF02::1
    FF02::2
  ICMP redirects are enabled
  ICMP unreachables are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 1000 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.
  IPv6 uRPF: strict mode (drop invalid packets)
  Inbound access list: FILTER-IPv6

Based on this output, which two features are configured on this interface?

Accepted Answer

uRPF in strict mode and inbound IPv6 ACL. The output shows 'IPv6 uRPF: strict mode (drop invalid packets)' and 'Inbound access list: FILTER-IPv6', confirming that unicast Reverse Path Forwarding in strict mode and an inbound IPv6 ACL are both configured on the interface. Strict uRPF verifies that the source address of incoming packets has a matching route in the FIB pointing back to the same interface, dropping packets that fail this check. The inbound ACL filters traffic before any routing decision, as indicated by the 'Inbound access list' line.

Answer

uRPF in loose mode and outbound IPv6 ACL

Answer

uRPF disabled and inbound IPv6 ACL

Answer

uRPF in strict mode and outbound IPv6 ACL

Question 3

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list PERMIT-ONLY
IPv6 access list PERMIT-ONLY
    permit ipv6 2001:DB8:3::/48 any sequence 10

Based on this output, what is the effect of this access list when applied to an interface?

Accepted Answer

It permits only IPv6 traffic from 2001:DB8:3::/48 and denies everything else. Option B is correct because an IPv6 access list, like its IPv4 counterpart, has an implicit deny all at the end. The single permit entry for source 2001:DB8:3::/48 allows only traffic from that prefix; all other IPv6 traffic is denied by the implicit deny ipv6 any any rule.

Answer

It permits all IPv6 traffic

Answer

It denies all IPv6 traffic from 2001:DB8:3::/48

Answer

It permits all IPv6 traffic except from 2001:DB8:3::/48

Question 4

Examine the following IPv6 ACL applied to an interface:

ipv6 access-list FILTER
 permit ipv6 any any fragments
 deny ipv6 any any

interface GigabitEthernet0/1
 ipv6 traffic-filter FILTER in

What is the effect of this configuration?

Accepted Answer

Only fragmented IPv6 packets are permitted; all other IPv6 traffic is denied.. Option B is correct because the ACL explicitly permits only fragmented IPv6 packets via the 'permit ipv6 any any fragments' statement, while the subsequent 'deny ipv6 any any' statement denies all other IPv6 traffic. Since ACLs are processed sequentially, the permit for fragments is evaluated first, allowing only fragmented packets; all non-fragmented packets are then denied by the second entry.

Answer

All IPv6 traffic is permitted because the permit statement matches any packet.

Answer

The ACL is invalid because 'fragments' cannot be used with 'any any'.

Answer

The interface command is missing the 'ipv6 enable' prerequisite.

Question 5

Consider the following configuration:

ipv6 access-list BLOCK-ICMP
 deny icmp any any echo-request
 deny icmp any any echo-reply
 permit ipv6 any any

interface GigabitEthernet0/2
 ipv6 traffic-filter BLOCK-ICMP in

Which statement is true?

Accepted Answer

The ACL blocks ICMP echo-request and echo-reply, but permits all other IPv6 traffic inbound.. Option A is correct because the IPv6 ACL explicitly denies ICMPv6 echo-request and echo-reply messages (types 128 and 129) while the final permit ipv6 any any statement allows all other IPv6 traffic. The ipv6 traffic-filter command applied inbound on GigabitEthernet0/2 filters traffic as it enters the interface, so only the specified ICMP types are blocked, and all other IPv6 traffic is permitted.

Answer

The ACL blocks all ICMPv6 traffic because the deny statements are too broad.

Answer

The ACL must be applied outbound to filter echo-request.

Answer

The ACL is missing the 'log' keyword to be effective.

Question 6

Review the following configuration:

ipv6 access-list FILTER
 permit tcp 2001:db8:1::/48 any eq 80
 permit tcp 2001:db8:1::/48 any eq 443
 deny ipv6 any any

interface GigabitEthernet0/3
 ipv6 traffic-filter FILTER out

What is the effect of this configuration?

Accepted Answer

Only HTTP and HTTPS traffic from 2001:db8:1::/48 is permitted outbound; all other traffic is denied.. Option A is correct because the IPv6 ACL named FILTER explicitly permits TCP traffic from source prefix 2001:db8:1::/48 to any destination on ports 80 (HTTP) and 443 (HTTPS), and then denies all other IPv6 traffic. Applied as an outbound traffic filter on GigabitEthernet0/3, this configuration restricts outbound traffic to only HTTP and HTTPS sessions originating from the specified prefix.

Answer

All traffic from 2001:db8:1::/48 is permitted because the ACL does not specify destination prefix.

Answer

The ACL is misconfigured because 'out' should be 'in' for source-based filtering.

Answer

The ACL permits all traffic because the deny statement is implicit.

Question 7

Examine this configuration:

interface GigabitEthernet0/4
 ipv6 address 2001:db8:2::1/64
 ipv6 verify unicast source reachable-via any

What is the effect of the 'ipv6 verify unicast source reachable-via any' command?

Accepted Answer

The router performs loose uRPF: the source address must be reachable via any route in the FIB.. This enables uRPF (unicast Reverse Path Forwarding) in loose mode. It checks that the source address of incoming packets is reachable via any route in the FIB, but does not require the exact interface.

Answer

The router performs strict uRPF: the source address must be reachable via the same interface the packet arrived on.

Answer

The router drops all packets with source addresses not in the same subnet as the interface.

Answer

The command is invalid because 'ipv6 verify unicast' requires a route-map.

Question 8

Consider the following configuration:

ipv6 access-list FILTER
 permit ipv6 2001:db8:3::/48 any
 deny ipv6 any any

interface GigabitEthernet0/5
 ipv6 traffic-filter FILTER in
 ipv6 verify unicast source reachable-via rx

A packet arrives on GigabitEthernet0/5 with source 2001:db8:3::100 and destination 2001:db8:4::1. The route for 2001:db8:3::/48 points out interface GigabitEthernet0/6. What happens?

Accepted Answer

The packet is dropped by uRPF because strict mode requires the source to be reachable via the receiving interface.. The ACL permits the packet (source matches prefix). However, uRPF in strict mode (rx) checks that the source is reachable via the same interface the packet arrived on. Since the route points to a different interface, uRPF drops the packet.

Answer

The packet is permitted because the ACL matches and uRPF is not applied.

Answer

The packet is dropped by the ACL because the deny statement blocks all traffic.

Answer

The packet is permitted because uRPF only checks destination addresses.

Question 9

Review this configuration:

route-map RMAP permit 10
 match ipv6 address prefix-list PREFIX
 set interface null0
!
ipv6 prefix-list PREFIX seq 5 permit 2001:db8:5::/48
!
interface GigabitEthernet0/6
 ipv6 verify unicast source reachable-via any allow-default

What is the purpose of the 'allow-default' keyword?

Accepted Answer

It allows uRPF to use the default route as a valid path for source reachability.. The 'allow-default' keyword permits packets whose source address is reachable via a default route. Without it, loose uRPF would drop packets with sources matching only a default route.

Answer

It allows the router to accept packets with source addresses from the default prefix.

Answer

It disables uRPF for packets matching the default route.

Answer

It is used to allow multicast traffic through uRPF.

Question 10

In IPv6, what is the default action for an access-list entry that does not specify a protocol?

Accepted Answer

The ACE is invalid and ignored.. IPv6 ACLs require a protocol keyword (e.g., tcp, udp, icmp, ipv6). If omitted, the ACE is invalid and ignored.

Answer

The ACE defaults to 'permit ipv6'.

Answer

The ACE defaults to 'deny ipv6'.

Answer

The ACE matches all IPv6 traffic.

Question 11

What is the default uRPF mode when 'ipv6 verify unicast source reachable-via' is configured without any keyword?

Accepted Answer

Strict mode (rx). If no keyword is specified, the default is strict mode (rx).

Answer

Loose mode (any)

Answer

No uRPF is applied

Answer

Only default routes are allowed

Question 12

According to RFC 2460, what is the correct behavior when an IPv6 router receives a packet with a source address that is a multicast address?

Accepted Answer

The router drops the packet silently.. RFC 2460 specifies that multicast addresses must never be used as source addresses. Routers should drop such packets.

Answer

The router forwards the packet normally.

Answer

The router sends an ICMPv6 error message back to the source.

Answer

The router rewrites the source address to the link-local address of the interface.

Question 13

Which TWO commands can be used to verify IPv6 unicast RPF operation on an interface? (Choose TWO.)

Accepted Answer

show ipv6 interface. The show ipv6 interface command displays uRPF status per interface, and show ipv6 cef detail reveals CEF forwarding details including RPF checks. show ipv6 access-list is for ACLs, not uRPF; show ipv6 route does not show uRPF; show ipv6 traffic shows packet statistics, not per-interface uRPF status.

Answer

show ipv6 access-list

Answer

show ipv6 route

Answer

show ipv6 traffic

Question 14

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

Accepted Answer

IPv6 ACLs are applied to interfaces using the ipv6 traffic-filter command.. Option A is correct because the `ipv6 traffic-filter` command is the Cisco IOS command used to apply an IPv6 ACL to an interface for filtering inbound or outbound traffic. This is the direct IPv6 equivalent of the `ip access-group` command used for IPv4 ACLs, and it is the only valid method for applying IPv6 ACLs to filter traffic on a Cisco router interface.

Answer

IPv6 ACLs use wildcard masks similar to IPv4 ACLs.

Answer

IPv6 ACLs automatically permit ICMPv6 neighbor discovery traffic by default.

Answer

IPv6 ACLs support the remark keyword for documentation.

Question 15

Which THREE symptoms indicate that IPv6 unicast RPF is misconfigured or failing on an interface? (Choose THREE.)

Accepted Answer

Traffic from a valid source IP is being dropped on the interface.. uRPF drops packets if the source address is not reachable via the incoming interface. A syslog message about uRPF drops confirms this. The 'ipv6 verify unicast source reachable-via any' command is a configuration command, not a symptom. High CPU due to RPF checks is not typical; RPF is done in hardware (CEF). An increase in the 'ipv6_input' drop counter for 'RPF' indicates drops.

Answer

The command 'ipv6 verify unicast source reachable-via any' is present in the running config.

Answer

High CPU utilization is observed due to RPF processing.