hardMultiple SelectObjective-mapped
IPv6 uRPF Strict vs Loose Mode
Which TWO statements about IPv6 unicast RPF (uRPF) behavior in Cisco IOS-XE are correct? (Choose TWO.)
Quick Answer
The correct answer is that loose mode uRPF drops packets if the source address is not present in the FIB at all, while strict mode additionally requires the source prefix to match the incoming interface. This distinction is critical because IPv6 uRPF verifies the source address against the Forwarding Information Base (FIB), not the destination. Strict mode, enabled with `ipv6 verify unicast source reachable-via rx`, demands both a FIB match and that the return path exits the same interface, making it vulnerable to dropping legitimate traffic under asymmetric routing. Loose mode, set with `reachable-via any`, only checks for any FIB entry for the source, ignoring the interface, which is more tolerant of asymmetric paths but still blocks packets with completely bogus source addresses. On the Cisco CCNP ENARSI 300-410 exam, this topic tests your ability to differentiate between the two modes and their configuration commands, often with a trap involving the default mode—remember, the default is loose, not strict. A simple memory tip: “Strict is strict on the interface; Loose is loose on the interface.”
⚠ Common exam trap
Cisco often tests the misconception that uRPF is enabled by default or that it can be applied globally, when in fact it is an interface-level feature that must be explicitly configured per interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Strict mode uRPF drops packets if the source address is not reachable via the incoming interface.
IPv6 unicast RPF strict mode verifies that the source address of an incoming packet is reachable via the exact interface on which the packet arrived, according to the FIB. If the source address is not reachable through that interface, the packet is dropped. This prevents spoofed traffic from entering the network from an unexpected path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Strict mode uRPF drops packets if the source address is not reachable via the incoming interface.
Why this is correct
Correct. Strict mode requires the source prefix to be reachable via the exact incoming interface.
- ✓
Loose mode uRPF drops packets if the source address is not present in the FIB at all.
Why this is correct
Correct. Loose mode only checks that the source address exists in the FIB, ignoring the interface.
- ✗
The default uRPF mode on Cisco IOS-XE is strict mode.
Why it's wrong here
Incorrect. The default is loose mode when 'ipv6 verify unicast source reachable-via' is configured without specifying 'rx'.
- ✗
IPv6 uRPF can be applied globally using the 'ipv6 unicast-rpf' command.
Why it's wrong here
Incorrect. IPv6 uRPF is configured per interface using 'ipv6 verify unicast source reachable-via', not globally.
- ✗
uRPF checks both source and destination addresses in the IPv6 header.
Why it's wrong here
Incorrect. uRPF only verifies the source address against the FIB; destination address is not checked.
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE statements about IPv6 unicast RPF (uRPF) are true? (Choose THREE.)
hard- ✓ A.IPv6 uRPF uses the Forwarding Information Base (FIB) to verify source address reachability.
- ✓ B.IPv6 uRPF can be configured in strict mode or loose mode.
- ✓ C.IPv6 uRPF is configured on a per-interface basis.
- D.IPv6 uRPF checks the destination address of incoming packets.
- E.IPv6 uRPF is used to filter multicast traffic.
Why A: IPv6 unicast RPF (uRPF) leverages the Forwarding Information Base (FIB) to verify that the source address of an incoming packet is reachable via the interface on which the packet was received. The FIB contains the best routes from the routing table, and uRPF performs a reverse path lookup against it to ensure the source address is topologically correct. This prevents spoofed traffic from entering the network.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.