Security and Services →hardMultiple ChoiceObjective-mapped

350-501 Security and Services Practice Question

An engineer is implementing Unicast Reverse Path Forwarding (uRPF) on a provider edge (PE) router to mitigate IP spoofing. The customer-facing interface has a single static default route. Which uRPF mode should be used to provide anti-spoofing without causing false drops?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Loose mode

With a single default route, strict uRPF would fail because the reverse path check expects a specific route back to the source. Loose uRPF only checks if a route exists (including default) to the source, making it suitable.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
VRF mode
Why it's wrong here
VRF mode is used in MPLS VPN environments, not applicable here.
✗
Strict mode
Why it's wrong here
Strict mode requires an exact match route back to the source; with only a default route, legitimate traffic may be dropped.
✗
Feasible mode
Why it's wrong here
Feasible mode is not a standard uRPF mode in Cisco IOS XR.
✓
Loose mode
Why this is correct
Loose mode only checks that a route exists (including default) to the source, preventing spoofing with minimal false drops.

Go deeper

350-501 Security and Services Practice Question

Why each option matters

Option-by-option breakdown

Related to this question