NAT practice questions

GET - Create a new resource

Why wrong: GET is explicitly designed for safe retrieval, and its use for creation is incorrect because GET requests must not cause any side effects on the server—clients, proxies, and caches assume they are read-only. Creating a resource via GET would break the uniform contract of HTTP, leading to problems such as unintended resource creation from link prefetching, browser history, or web crawlers. Additionally, GET requests are not intended to carry complex payloads for entity creation; POST is the standard method for transmitting data that results in a new resource. RESTful APIs should rely on POST (and sometimes PUT) for creation semantics.

POST - Retrieve a resource

Why wrong: POST is defined for submitting data to be processed, typically resulting in the creation of a new resource or the triggering of a server-side action. Unlike GET, POST is neither safe nor idempotent, as each invocation can produce different outcomes or side effects. Using POST to merely retrieve a resource would violate the uniform interface principle of REST, because the server would need to interpret the request as a retrieval despite the method's established semantics. The correct retrieval method is always GET, which is explicitly designed for read-only operations.

PUT - Partially update a resource

Why wrong: PUT is intended to replace the entire representation of a target resource with the request payload, making it an idempotent operation—repeated identical PUT requests yield the same state. A partial update is specifically handled by PATCH, which applies a set of changes described in the request body without replacing the whole resource. Therefore, using PUT for a partial update misrepresents the method's semantics and can lead to unintended data loss if the full representation is not supplied. The distinction between PUT and PATCH is critical in RESTful API design.

The access list 'NAT' is incorrect; it should permit only specific hosts, not the entire subnet.

Why wrong: The access list 'NAT' is not the problem. In dynamic NAT, the ACL is used solely to identify which inside addresses are eligible for translation, and permitting the entire internal subnet is standard and correct when all internal hosts should have Internet access. Even if the ACL were narrowed to specific hosts, the router would still fail to translate return packets because the outside interface has not been designated with 'ip nat outside'. The ACL only controls which source addresses are translated, not whether NAT is applied on an interface.

The NAT configuration lacks the 'overload' keyword, so the pool is exhausted quickly.

Why wrong: The lack of the 'overload' keyword is a red herring here. Without overload, the router performs standard dynamic NAT, which still works correctly as long as the number of active inside addresses does not exceed the number of addresses in the pool. In the scenario, there are only 2 active translations and 11 addresses in the pool, so the pool is not exhausted and overload would not change the immediate outcome. The real issue is that the outside interface is not configured for NAT, and adding overload cannot compensate for that missing interface-level command.

The NAT pool 'POOL' has too few addresses; it should be expanded to a /24 subnet.

Why wrong: The NAT pool 'POOL' has 11 addresses, which is more than enough for the two active translations, so pool size is not causing the problem. Expanding the pool to a /24 subnet would only increase the maximum number of concurrent translations; it would not make the router process return traffic on the outside interface. Even with 254 public addresses available, the router would still not translate reply packets because the outside interface is not marked with 'ip nat outside'. The symptom of no replies is a direct result of missing interface NAT designation, not address exhaustion.

Standard IPv4 ACLs use numbers in the range 100-199.

Why wrong: Standard IPv4 ACLs are numbered in the ranges 1–99 and 1300–1999, not 100–199. The number range 100–199 is explicitly reserved for extended numbered ACLs, which evaluate source and destination IP addresses, protocol, and port numbers. Misidentifying 100–199 as standard ACL numbers confuses the ACL type and its underlying matching logic.

Standard IPv4 ACLs filter only the source IP address and are best placed close to the source to be most effective.

Why wrong: Standard ACLs indeed filter only on the source IP address, but that limited matching capability requires them to be placed as close to the destination as possible, not the source. If placed near the source, a standard ACL entry that denies a particular source would block that source's traffic to all destinations, including legitimate ones. Positioning near the destination limits the ACL's impact to the intended target network, avoiding accidental collateral denial.

Numbered ACLs allow individual access control entries (ACEs) to be deleted without removing the entire ACL.

Why wrong: Numbered ACLs do not permit deletion of an individual access control entry; to remove one ACE, the entire ACL must be deleted and re-entered without that entry. Named ACLs, in contrast, assign sequence numbers to each ACE, allowing selective deletion, insertion, and resequencing without recreating the full list. This operational limitation of numbered ACLs applies to both standard and extended numbered variants and is a common source of configuration errors.

Change the port type of Gi0/3 to trunk to allow multiple VLANs.

Why wrong: Configuring Gi0/3 as a trunk only affects VLAN tagging and the set of VLANs carried, not the STP port role. The blocking state indicates an STP decision—likely that the current root bridge has a higher bridge priority than another switch for VLAN 10—so the port cannot forward even after trunk mode is set. Trunking would be relevant if VLANs were being pruned, but it cannot change the root bridge election or port cost calculations.

Configure spanning-tree portfast on Gi0/3 to speed up convergence.

Why wrong: Portfast is intended solely for access ports connected to end stations, allowing them to bypass the listening and learning states to converge quickly. Applying it to an inter-switch uplink like Gi0/3 is dangerous because it could create a temporary bridging loop during STP recalculation. Even if Portfast were enabled, the port would still block after the switch receives the superior BPDU that elected another switch as root; it only skips the forward-delay timers, not the STP decision itself.

Enable BPDU guard on Gi0/3 to prevent unauthorized switches from affecting the network.

Why wrong: BPDU guard is an STP protection feature typically enabled on PortFast-configured access ports; when it receives a BPDU, it disables the port to prevent rogue switches. On an uplink connecting two switches, BPDUs are expected and necessary for STP operation, so enabling BPDU guard would shut down Gi0/3 and disrupt the link entirely. It does nothing to influence root bridge selection or why Gi0/3 is in a blocking state, since that state is determined by root bridge priorities and path costs.

Deploy a predictive analytics model to forecast future traffic volumes and adjust thresholds accordingly.

Why wrong: Predictive analytics models apply time-series forecasting to anticipate future traffic loads (e.g., bandwidth utilization during peak hours) and proactively adjust thresholds. This approach is inherently prospective—it does not compute a real-time baseline of 'normal' behavior across multiple features, so it cannot distinguish a genuine security anomaly from a routine but irregular spike. Adjusting thresholds based on forecasts may actually increase false positives when the forecast is inaccurate, and it still lacks the per-flow or per-host behavioral comparison needed to suppress alert noise.

Apply intent-based networking to automatically enforce security policies based on high-level business intent.

Why wrong: Intent-based networking (IBN) automates the translation of high-level business policies into concrete device configurations and continuously validates that the network state meets that intent. However, IBN operates on policy assurance and configuration management; it does not ingest traffic telemetry to learn what normal traffic looks like, nor does it classify live traffic as benign or malicious. False positive alerts from an existing NMS or IDS remain untouched because IBN does not add a layer of statistical or behavioral analysis to the monitoring pipeline—it simply enforces and verifies the intended state.

Use deep packet inspection to examine all traffic and create static rules for known threats.

Why wrong: Deep packet inspection (DPI) examines packet payloads against a signature database to identify known attack patterns, then applies static rules (e.g., drop or alert). While DPI is effective for known exploits, it is blind to behavioral anomalies that have no matching signature—zero-day attacks or subtle deviations in traffic volume, latency, or flow topology. Because the rules are static, they cannot adapt to evolving baseline behavior, so legitimate traffic that coincidentally resembles a signature (e.g., a malformed but benign packet) triggers false positives, and genuinely abnormal traffic without a signature goes unnoticed.

The default gateway must be removed from the DHCP scope.

Why wrong: Removing the default gateway from the DHCP scope would eliminate the router as the next hop, breaking all off-subnet communication. The problem is isolated to hostname resolution while IP connectivity succeeds, so a missing gateway would cause total network failure, not just DNS failure. Therefore, the default gateway must remain in the scope and cannot be the cause.

The clients must use PPP before DNS works.

Why wrong: PPP (Point-to-Point Protocol) is a WAN data-link encapsulation used on serial or DSL links, not a service required for DNS on an Ethernet LAN. DNS resolution operates over IP and is independent of the data-link protocol; clients do not need PPP to send DNS queries. This option incorrectly conflates a WAN technology with local DHCP operation and is unrelated to the VLAN 70 issue.

The VLAN must be converted to the native VLAN on all trunks.

Why wrong: The native VLAN in 802.1Q trunks carries untagged frames; changing VLAN 70 to native would affect trunk tagging and could cause broadcast or misdelivery issues. However, the symptom is specifically that clients reach services by IP but not by hostname, indicating a DNS problem, not a Layer 2 forwarding issue. If the native VLAN were misconfigured, general connectivity would fail, not just name resolution.

GET - Create data

Why wrong: GET is not designed for creation because it is a safe, read-only operation that must not alter server state or trigger side effects. Creating data requires sending a request payload and invoking server-side processing, which is the semantic role of POST. Using GET to create resources violates HTTP constraints, leading to problems such as unintended cacheable state changes and vulnerability to cross-site request forgery.

POST - Retrieve data

Why wrong: POST is not intended for retrieval because it is designed to submit data to a specified resource for processing, typically causing state changes or resource creation. Retrieval is a read-only operation that should use GET, which is safe and idempotent. Although POST can return data in a response, its primary semantic is server-side processing rather than querying existing resources.

PUT - Partially update data

Why wrong: PUT is defined to replace an entire resource with the representation in the request body, making it inappropriate for partial updates. A partial update modifies only a subset of a resource's fields, which is the purpose of the PATCH method. Because PUT is idempotent and requires the complete new state, applying it to a partial payload would cause missing fields to be reset or removed.

Because OSPF always overrides static routing, regardless of prefix length.

Why wrong: The premise that OSPF automatically overrides static routing is false; routing decisions prioritize longest prefix match first, and only when prefix lengths are equal does administrative distance break the tie. A static route has an administrative distance of 1, which is far lower than OSPF's 110, so a static /24 would be preferred for that prefix. The real reason the OSPF route wins here is that the /26 route has a longer prefix length than the static /24, not because of the protocol type.

Because the static route must have an administrative distance of 255 to be considered.

Why wrong: The static route does not need to have an administrative distance of 255 to be considered; in fact, an AD of 255 is treated as unreachable and would not be installed in the routing table. The static route is indeed valid and present, but its /24 prefix is less specific than the OSPF /26 route. Cisco IOS selects routes based on the longest prefix match first, so the more specific /26 route wins regardless of the static route's administrative distance.

Because the destination 198.51.100.70 is outside both listed routes.

Why wrong: The destination 198.51.100.70 is not outside both routes—it lies within the static /24 range of 198.51.100.0 through 198.51.100.255 and also within the OSPF /26 range of 198.51.100.64 through 198.51.100.127. Since .70 is between .64 and .127, it is covered by the more specific OSPF route. Therefore, the claim that it is outside either network is incorrect.

172.16.0.0/16

Why wrong: Although 172.16.20.200 is within the 172.16.0.0/16 address block, this route has a prefix length of only 16 bits. The router selects the route with the longest matching prefix; since the routing table contains more specific routes (172.16.20.0/24 and 172.16.20.128/25), the /16 route is not considered for forwarding. It would only be used if no longer prefix matches existed. Its broad summary covers many subnets, but that generality disqualifies it in favor of the more exact /25 entry.

172.16.20.0/24

Why wrong: While 172.16.20.0/24 does encompass the destination IP address 172.16.20.200, it is not the route selected. Routers utilise the Longest Prefix Match rule, which dictates that the most specific route available in the routing table for a given destination IP address will be chosen. In this scenario, 172.16.20.128/25 is a more precise match. This option would be correct if the 172.16.20.128/25 route were absent, as it would then represent the longest prefix match.

The default route

Why wrong: A default route, typically 0.0.0.0/0, matches every destination IP address. However, it has the shortest possible prefix length (0), making it the least specific route. The longest prefix match algorithm always prefers the route with the greatest number of matching bits; here, both 172.16.20.0/24 and 172.16.20.128/25 match the destination with longer prefixes, so the default route is never selected for this packet. It serves only as a last resort when no other route matches the destination network.

Standard ACLs should be placed as close to the source as possible.

Why wrong: Placing a standard ACL close to the source is incorrect because it will evaluate every packet from that source regardless of its final destination, potentially dropping traffic that should be allowed to other networks. Since standard ACLs cannot match the destination address, a permit or deny statement applies globally to all destinations for the specified source. Cisco recommends applying standard ACLs near the destination, while extended ACLs — which can match destination — should indeed be placed close to the source to reduce unnecessary transit traffic.

Standard ACLs can filter traffic based on destination IP address.

Why wrong: Standard ACLs do not look at the destination IP address at all — each ACE contains only a permit/deny decision based on the source address, with an optional wildcard mask. Because the router never inspects the destination field of the packet, a standard ACL cannot differentiate between traffic going to one host and traffic going to another. This is why extended ACLs are required when you need to match both source and destination addresses.

Standard ACLs can filter traffic based on TCP or UDP port numbers.

Why wrong: Standard ACLs cannot filter by TCP or UDP port numbers because they operate only at Layer 3 and match solely on the source IP address and wildcard mask. Port fields are Layer 4 information, which the standard ACL code never examines; only an extended ACL (numbered 100–199 or named) can specify protocol and port numbers in its entries. Thus, any attempt to use a standard ACL to block a specific web service or application port will fail.

The trunk must be converted to an access port for VLAN 20 to work.

Why wrong: An access port is designed to carry a single untagged VLAN, so converting the trunk to an access port would force it to carry only the VLAN assigned as the access VLAN, such as VLAN 20. This would drop the tags for VLANs 10 and 30, making them unreachable across the link, which defeats the purpose of a trunk that must carry all three VLANs. Furthermore, trunk ports are the standard mechanism for inter-switch multi-VLAN traffic, and a misconfigured allowed list is a filtering problem, not a port-mode problem.

VLAN 20 must always be the native VLAN.

Why wrong: The native VLAN on an 802.1Q trunk is the VLAN that is transmitted without an 802.1Q tag; it is an untagged path used for control traffic and for devices that do not support VLAN tagging. VLAN 20 can be carried either as a tagged VLAN or as the native VLAN, but setting it as native would simply change the tagging behavior, not the allowed list. If VLAN 20 is missing from the allowed list, even untagged frames for the native VLAN will not be forwarded. Thus, native VLAN assignment is independent from the VLAN membership filtering issue.

The switches must both use ISL instead of 802.1Q.

Why wrong: ISL and 802.1Q are different trunking encapsulations; both use their own tagging format and both are capable of carrying VLAN 20 across a trunk. The problem described is that VLAN 20 is not in the allowed list on one side, which is a VLAN filter applied at the interface level regardless of the encapsulation protocol. Even if both switches were configured for ISL, the missing VLAN would still be omitted from the allowed list, so the traffic would still be blocked. Additionally, most Cisco switches today default to 802.1Q, and mixing encapsulations would break the trunk entirely.

The static route overrides OSPF immediately because static routes always win.

Why wrong: Static routes do not 'always win' because route selection is based on administrative distance, not on the route type alone. By default, a static route has an AD of 1, which normally beats OSPF's 110, but here the static route's AD has been configured higher than OSPF's, allowing OSPF to remain preferred. Therefore, it is the specific numeric AD values that determine preference, not a blanket rule that static outranks dynamic routing.

Both routes must be installed simultaneously because they point to the same destination.

Why wrong: The router does not install both routes just because they point to the same destination; it installs only the one with the best (lowest) administrative distance for that prefix. Both routes would be installed only if they had equal AD and formed equal-cost multipath (ECMP), or if they addressed different prefixes. Since the same destination and differing ADs mean only OSPF is selected, simultaneous installation is not required.

The router removes the OSPF route because the static route has a manually configured distance.

Why wrong: A manually configured distance does not cause the router to remove the OSPF route. The router selects the route with the lowest AD for the destination; because the static route's manually configured distance is higher than OSPF's 110, OSPF remains the best route and stays in the routing table. The static route is simply not installed, and OSPF is not removed merely because a static route with a higher distance exists.

Set the interface network type to point-to-point

Why wrong: Setting the OSPF network type to point-to-point on the interface changes timer values and eliminates DR/BDR election, but Hellos are still sent periodically and the interface remains fully active in the OSPF process. Since the requirement is to prevent Hello transmission while still advertising the connected network, this does not satisfy it. The point-to-point type is appropriate for serial links but does not suppress adjacency formation.

Apply distribute-list out on the interface

Why wrong: A distribute-list out is used to filter routes from being advertised in routing updates, but OSPF does not use it to suppress Hellos; OSPF relies on the Hello protocol for neighbor discovery. This command operates on the routing table and redistributed routes, not on interface-level OSPF processes like Hello transmission. Thus, applying a distribute-list out on the interface has no bearing on whether the interface sends or receives Hellos.

NETCONF uses HTTP methods such as GET, POST, PUT, and DELETE to manipulate configuration data.

Why wrong: NETCONF does not run over HTTP; it uses XML-based Remote Procedure Calls (RPCs) carried over a secure, connection-oriented transport such as SSH (port 830) or TLS. Operations like <get-config>, <edit-config>, and <commit> are exchanged as XML messages, not as HTTP GET/POST/PUT/DELETE requests. HTTP method semantics are specific to RESTCONF, which is a distinct protocol.

NETCONF uses a separate commit operation to apply changes, while RESTCONF uses a similar commit mechanism.

Why wrong: NETCONF provides a candidate configuration datastore with a distinct <commit> operation (and optional <rollback>) to atomically apply a set of changes. RESTCONF, however, does not implement a separate commit phase; every HTTP request (e.g., POST, PUT, PATCH) directly modifies the intended running datastore immediately. Therefore, saying RESTCONF uses a similar commit mechanism is incorrect; RESTCONF cannot provide multi-change atomic transactions like NETCONF's candidate datastore.

The OSPF route is installed because cost 20 is lower than metric 0

Why wrong: This statement incorrectly compares OSPF's cost (20) to the static route's metric (0) and assumes a lower number wins. In Cisco IOS, a router first compares administrative distance when multiple routing sources provide a path to the same network; only if AD values are equal are metrics compared. Since the static route's AD of 5 is much lower than OSPF's default AD of 110, the static route is installed into the routing table despite OSPF having a lower metric value. The OSPF cost is irrelevant until the static route is removed, at which point OSPF becomes the active route by default, not because its cost is lower.

Both routes are installed as equal-cost paths automatically

Why wrong: Equal-cost multipath (ECMP) only applies when multiple routes to the same prefix have the same administrative distance and the same metric, and they are usually from the same routing protocol. Here the static route has an AD of 5 while OSPF has an AD of 110, so they are not equal from the router's perspective. Moreover, their metrics—0 for the static and 20 for OSPF—are not comparable across different protocols. Therefore, the router does not install both; it selects only the static route as the single best path.

All tagged VLAN traffic is automatically converted to routed traffic

Why wrong: A native VLAN mismatch does not alter the fundamental operation of a trunk link, which remains a Layer 2 forwarding path. The 802.1Q tag is still applied to frames from all non-native VLANs, and those frames are switched based on MAC addresses exactly as they would be with a correctly configured trunk. There is no mechanism that converts tagged VLAN traffic into routed traffic; routing would only occur if the frames are sent to a Layer 3 interface, which is a separate configuration unrelated to trunk native VLAN settings.

The mismatch forces OSPF adjacency reset on all routers

Why wrong: A native VLAN mismatch is a Layer 2 trunking misconfiguration; it directly affects only how untagged frames are interpreted on the trunk. OSPF adjacency is a Layer 3 routing process that relies on IP reachability and multicast hello packets, not on the native VLAN assignment of a trunk. While an IP connectivity issue could indirectly cause OSPF neighbors to go down, the mismatch itself does not force an OSPF adjacency reset on any router, and OSPF has no mechanism that reacts specifically to trunk native VLAN mismatches.

The trunk can carry only one VLAN until the mismatch is cleared

Why wrong: An 802.1Q trunk is designed to carry multiple VLANs simultaneously by adding a 4-byte tag to frames from all VLANs except the native VLAN. When a native VLAN mismatch exists, the untagged frames on the native VLAN are mishandled, but frames from other VLANs remain correctly tagged and continue to traverse the trunk normally. Therefore the trunk does not become limited to a single VLAN; it continues to transport all configured tagged VLANs, and only the untagged native VLAN traffic is subject to misassociation.

The interface received a superior BPDU and became the root port.

Why wrong: STP role changes like becoming a root port occur when a superior BPDU is received, but that event would be reflected in spanning-tree state transitions and forwarding behavior, not in a security intrusion log. A hub does not originate BPDUs, and the error message clearly identifies a port-security violation rather than an STP topology change. Therefore, the interface's down state is due to security enforcement, not a spanning-tree decision.

The hub forced the interface to become a routed port.

Why wrong: A hub is a Layer 1 device that simply forwards electrical signals, so it cannot change the logical mode of a switch interface. A routed port is created only by explicitly removing Layer 2 switching with the "no switchport" command, which is not shown here. The log message references a port-security violation, not a change in interface mode.

DHCP snooping always shuts a port when a hub is attached.

Why wrong: DHCP snooping filters DHCP messages based on whether a port is trusted or untrusted; it does not count MAC addresses or react to the simple attachment of a hub. A hub only extends the collision domain, and it does not generate DHCP traffic or cause a DHCP snooping violation by itself. The exhibit shows a port-security restriction on secure MAC addresses, not any DHCP-related action.

Because allowing a VLAN on a trunk automatically disables it

Why wrong: The command 'switchport trunk allowed vlan add 99' merely adds VLAN 99 to the list of VLANs whose tagged frames may traverse the trunk. This does not disable the VLAN; in fact, it explicitly permits it. A VLAN is disabled by using the 'no vlan 99' to remove it or 'shutdown vlan 99' to administratively bring it down. Thus, allowing a VLAN on a trunk never automatically disables it; the two operations are completely independent.

Because VLANs can cross trunks only when PAT is enabled

Why wrong: PAT (Port Address Translation) is a Network Address Translation technique that maps multiple private IP addresses to a single public IP address for outbound Internet traffic. Trunk operation is a Layer 2 function where 802.1Q tags in Ethernet frames identify different VLANs as they traverse a trunk link. PAT has no relationship to Layer 2 VLAN tagging or carriage across a trunk. VLANs cross trunks purely via 802.1Q or ISL encapsulation, not through PAT or any other Layer 3 translation mechanism.

Because VLAN 99 must always be the native VLAN

Why wrong: The native VLAN is a special VLAN on an 802.1Q trunk that carries its frames untagged, typically configured with 'switchport trunk native vlan <vlan-id>'. There is no requirement that VLAN 99 be the native VLAN; any VLAN can be configured as native, and any VLAN can be carried across a trunk as a tagged VLAN. If VLAN 99 is not the native VLAN, it simply sends and receives 802.1Q-tagged frames. Therefore, needing VLAN 99 to be the native VLAN is a misconception; its operability depends on it being defined and active, not on its native status.

The path with the higher OSPF metric

Why wrong: Selecting the path with the higher OSPF metric would contradict OSPF's SPF calculation, which always chooses the least-cost path to a destination. A higher cost indicates a less desirable route, such as one traversing slower or more numerous links, and OSPF will never prefer it over a lower-cost alternative for the same prefix. The only time a higher-metric path is used is if the lower-metric path is absent from the routing table.

Both paths equally, because the administrative distance is the same

Why wrong: Administrative distance is a Cisco-specific trust rating assigned to the routing protocol as a whole, not a per-path metric for selecting among OSPF routes. When two OSPF paths to the same prefix have unequal metrics, the router compares the OSPF cost values directly, and the lower-cost path wins. Equal AD only means both routes are equally trusted as OSPF-learned; it does not enable load balancing, which would require the OSPF metrics to be exactly equal.

Neither path, because two OSPF routes to the same prefix are invalid

Why wrong: OSPF is fully capable of learning the same prefix through multiple paths, as occurs in redundant OSPF networks where the SPF algorithm evaluates all available routes. Having two OSPF routes to 10.10.10.0/24 is not invalid; rather, OSPF processes them and selects the one with the lowest metric for installation in the routing table, while potentially keeping equal-cost paths for ECMP. Discarding both routes would leave the network without a route, which OSPF would never do if any path exists.

A NAT rule translating IPv6 to IPv4

Why wrong: IPv6 was designed to restore end-to-end connectivity without relying on NAT; in normal native IPv6 environments, routing uses global unicast addresses directly. A NAT rule that translates IPv6 to IPv4 would be an unnecessary and complex workaround, and it would not help the host reach off-link IPv6 destinations unless that IPv4 path itself is routed. Since the host already reaches neighbors using IPv6, the missing element is not address translation but a route to a default gateway.

A VLAN trunk on the host NIC

Why wrong: VLAN trunking is a Layer 2 feature used to carry multiple VLANs over a single switch link, typically between switches or to a router-on-a-stick. An end host NIC rarely requires trunking, and the symptom described is unrelated to VLAN tagging because it concerns Layer 3 reachability. Even if the NIC were configured with a trunk, that would not provide a default route or next hop for off-link IPv6 packets.

A second global unicast address on the same interface

Why wrong: Adding a second global unicast address to the same interface only provides an additional source or destination identifier for that interface; it does not install any route or gateway information into the host's IPv6 routing table. The host still lacks a default route for off-link traffic, and the existing address already satisfies the requirement of having a valid IPv6 source address. Therefore, a duplicate address does not solve the described reachability problem.