hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures 'ipv6 verify source' with…
An engineer configures 'ipv6 verify source' with 'allow-default' on a switch port connected to a router that uses a default route via a static route. The router's traffic is being dropped by Source Guard. The engineer sees that the router's source address is in the binding table. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the misconception that 'allow-default' permits all traffic from a router, when in fact it only permits traffic matching the specific default route entry in the binding table, typically the router's link-local address learned via RA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'allow-default' option only permits traffic with source address matching the default route entry, not all traffic.
The 'allow-default' keyword in the 'ipv6 verify source' command only permits traffic whose source IPv6 address matches the default route entry (::/0) in the binding table. It does not allow all traffic; it specifically allows traffic from the default router's link-local address that is associated with the default route. Since the router's source address is in the binding table but the traffic is still dropped, the issue is that the router is sending packets with a source address that does not match the default route entry, or the default route entry itself is not properly installed in the binding table. The 'allow-default' option is not a blanket pass for all traffic from the router.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The 'allow-default' option only permits traffic with source address matching the default route entry, not all traffic.
Why this is correct
It allows traffic from the default prefix, not all sources.
- ✗
The router's source address is a link-local address, which is not supported by Source Guard.
Why it's wrong here
Link-local addresses are supported but must be in the binding table.
- ✗
The 'allow-default' option requires the router to send an NA for the default route.
Why it's wrong here
The binding entry for default must be configured statically.
- ✗
The switch port must be configured as 'trusted' for Source Guard to work with routers.
Why it's wrong here
No trust concept for Source Guard.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.