Question 16 of 2,011
hardMultiple SelectObjective-mapped
300-410 Practice Question: Which TWO actions will prevent IPv6 traffic with…
Which TWO actions will prevent IPv6 traffic with a spoofed source address from being forwarded in a network where BGP is used for routing? (Choose TWO.)
⚠ Common exam trap
Cisco often tests the distinction between uRPF loose mode and strict mode, and the trap here is that candidates may think 'ipv6 verify unicast source reachable-via any allow-default' is a valid anti-spoofing measure, when it actually permits traffic with a source reachable via the default route, undermining the purpose of source address validation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply uRPF loose mode on the customer-facing interface.
URPF (Unicast Reverse Path Forwarding) loose mode checks the source address of incoming IPv6 traffic against the routing table to ensure a route exists back to that source, without requiring the exact interface. This prevents spoofed source addresses from being forwarded when no route exists for the claimed source. Option B is correct because an inbound IPv6 ACL on the edge interface can explicitly deny traffic from reserved prefixes (e.g., RFC 6890) or internal prefixes that should never appear as source addresses from outside, effectively blocking spoofed traffic at the ingress point.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply uRPF loose mode on the customer-facing interface.
Why this is correct
Correct. uRPF loose mode drops packets if the source address is not in the FIB, which helps prevent spoofing.
- ✓
Configure an inbound IPv6 ACL on the edge interface that denies traffic from reserved or internal source prefixes.
Why this is correct
Correct. This blocks traffic with obviously spoofed source addresses (e.g., from internal ranges or reserved addresses).
- ✗
Use the 'ipv6 verify unicast source reachable-via any allow-default' command to allow traffic with default route.
Why it's wrong here
Incorrect. The 'allow-default' option permits traffic even if the source is only reachable via a default route, which reduces spoofing protection.
- ✗
Apply an outbound IPv6 ACL on the BGP neighbor interface to filter spoofed source addresses.
Why it's wrong here
Incorrect. Outbound ACLs filter traffic leaving the router, not incoming spoofed traffic. Spoofed traffic enters the network, so inbound filtering is needed.
- ✗
Disable BGP prefix filtering to allow all prefixes, then rely on uRPF only.
Why it's wrong here
Incorrect. Disabling prefix filtering would allow potentially malicious prefixes to be installed, making uRPF less effective. Combining both is better.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.