mediumMultiple Choice
300-410 Practice Question: Runs the following command on Router R1: R1# show…
A network engineer runs the following command on Router R1:
R1# show ipv6 access-list PERMIT-ONLY
IPv6 access list PERMIT-ONLY
permit ipv6 2001:DB8:3::/48 any sequence 10
Based on this output, what is the effect of this access list when applied to an interface?
⚠ Common exam trap
Cisco often tests the implicit deny any any behavior in IPv6 ACLs, tricking candidates into thinking that a single permit entry allows all traffic or that the ACL only filters the specified prefix without affecting other traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It permits only IPv6 traffic from 2001:DB8:3::/48 and denies everything else
An IPv6 access list, like its IPv4 counterpart, has an implicit deny all at the end. The single permit entry for source 2001:DB8:3::/48 allows only traffic from that prefix; all other IPv6 traffic is denied by the implicit deny ipv6 any any rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It permits all IPv6 traffic
Why it's wrong here
Only traffic sourced from 2001:DB8:3::/48 matches the single permit entry; everything else hits the implicit deny. The option tempts those who overlook the source prefix, but a bare permit ipv6 any any would be needed to allow all IPv6 traffic. This ACL is correct for restricting to one prefix.
- ✓
It permits only IPv6 traffic from 2001:DB8:3::/48 and denies everything else
Why this is correct
An IPv6 access list ends with an implicit deny any, so the single permit statement for 2001:DB8:3::/48 means only that prefix is allowed and all other IPv6 traffic is dropped when the list is applied to the interface.
- ✗
It denies all IPv6 traffic from 2001:DB8:3::/48
Why it's wrong here
The keyword permit grants matching traffic from 2001:DB8:3::/48 rather than dropping it. Confusion arises because ACLs end with an implicit deny, but that applies to unmatched packets, not to this explicit permit entry. A deny statement would be correct if the goal were to block that prefix.
- ✗
It permits all IPv6 traffic except from 2001:DB8:3::/48
Why it's wrong here
The entry is a permit statement matching source 2001:DB8:3::/48, so that prefix is allowed, not excluded. The inverse reading tempts engineers used to implicit deny logic, but an explicit deny would need a deny statement; this ACL would be the right choice only when you genuinely want to whitelist that prefix.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.