hardMultiple ChoiceObjective-mapped
300-410 Practice Question: A dual-stack network uses BGP for IPv6 between…
A dual-stack network uses BGP for IPv6 between two ISPs. R1 (AS 100) receives a full BGP table from R2 (AS 200). R1 has an IPv6 ACL applied inbound on the interface to R2 that permits only BGP (TCP 179) and denies all other traffic. R1 also has uRPF configured in strict mode on the same interface. R1's BGP table has a route to 2001:db8:1::/48 with next-hop 2001:db8:2::2. R1's routing table shows the route, but traffic from R1 to 2001:db8:1::1 fails. R1 shows 'show ipv6 cef 2001:db8:1::/48' points to 2001:db8:2::2 via the interface to R2. What is the root cause?
⚠ Common exam trap
Cisco often tests the directional nature of ACLs—candidates assume an inbound ACL only affects traffic initiated from the remote side, forgetting that return traffic for locally initiated sessions is also subject to the inbound ACL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL on R1 blocks the return traffic from the destination, which is not BGP, causing the ping to fail.
The IPv6 ACL on R1 permits only BGP (TCP port 179) inbound from R2. When R1 sends a ping to 2001:db8:1::1, the return ICMPv6 echo-reply traffic from the destination (via R2) is not BGP and is therefore denied by the inbound ACL, causing the ping to fail. The BGP table and routing table are correct, but the ACL blocks the non-BGP return traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL on R1 blocks the return traffic from the destination, which is not BGP, causing the ping to fail.
Why this is correct
The ACL permits only BGP. Return traffic (ICMPv6 echo reply) is blocked, so the ping fails.
- ✗
uRPF strict mode drops the outgoing traffic because the source address is not reachable via the interface.
Why it's wrong here
uRPF checks incoming traffic, not outgoing.
- ✗
The next-hop 2001:db8:2::2 is not reachable due to a missing ND entry.
Why it's wrong here
If ND were missing, the route would not be installed in CEF.
- ✗
BGP next-hop resolution fails because the next-hop is not in the FIB.
Why it's wrong here
The route is installed, so next-hop resolution succeeded.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.