CCNP Practice Question: Consider the following IPv6 access-list on a…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Only IPv6 ping (echo-request and echo-reply) is allowed inbound on Gi0/0; all other IPv6 traffic is dropped.

  Why this is correct

  The ACL on Gi0/0 contains two permit statements matching ICMPv6 echo-request (type 128) and echo-reply (type 129), followed by an explicit deny statement for all other IPv6 traffic. Because the ACL is applied inbound with the 'in' keyword, only packets entering the interface that match these two permit statements are forwarded; any other IPv6 packet is dropped. This is a common security practice to allow ping while blocking other ICMPv6 control messages.

• ✗

  All ICMPv6 traffic is permitted inbound on Gi0/0.

  Why it's wrong here

  ICMPv6 encompasses many message types beyond echo-request and echo-reply, such as neighbor solicitation (type 135), neighbor advertisement (type 136), router solicitation (type 133), and router advertisement (type 134). The ACL in question explicitly permits only types 128 and 129, so claiming all ICMPv6 is allowed is false. Unspecified ICMPv6 types would not match the permit statements and would be caught by the final deny, resulting in dropping.

• ✗

  The ACL is applied outbound, so it filters traffic leaving Gi0/0.

  Why it's wrong here

  The 'in' keyword in the ACL ipv6 access-group command indicates the filter is applied to traffic entering the interface, not leaving it. If the ACL were applied outbound, it would inspect packets exiting Gi0/0, but the question's configuration specifies inbound processing. Misreading the direction would lead to incorrect placement, as applying it outbound would not achieve the desired filtering of incoming ping traffic.

• ✗

  The ACL permits all IPv6 traffic because the deny statement is at the end.

  Why it's wrong here

  ACL packet matching is sequential; a packet is evaluated against each line until a match occurs. Permitting all IPv6 traffic would require a permit ipv6 any any statement, but the ACL instead ends with an explicit deny ipv6 any any. The deny statement at the end does not 'permit' anything; it is the default drop for unmatched packets, ensuring that only the explicitly permitted echo-request and echo-reply traffic is forwarded.