How many IPv6 Configuration Scenarios questions are on this page?

This page has 15 IPv6 Configuration Scenarios scenario questions for the 300-410 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 300-410 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CCNP ENARSI 300-410 questions

Scenario-based practice

IPv6 Configuration Scenarios

Practise Cisco CCNP ENARSI 300-410 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

300-410

exam code

Cisco

vendor

Scenario guide

How to approach ipv6 configuration scenarios

IPv6 questions test address types (global unicast, link-local, multicast, anycast), address assignment (SLAAC, DHCPv6, EUI-64), OSPFv3, and dual-stack. The CCNA often presents an IPv6 address and asks you to identify the prefix, type, or calculate the EUI-64 interface ID.

Quick answer

IPv6 questions usually test address types (link-local, global unicast, ULA), autoconfiguration (SLAAC), Neighbor Discovery Protocol and the differences from IPv4.

IPv6 address types and their scopes (link-local, global unicast, multicast, ULA).

SLAAC vs DHCPv6 vs stateful assignment.

Neighbor Discovery Protocol replacing ARP.

IPv6 routing differences and dual-stack coexistence.

Practice scenarios

Question 1mediummultiple choice

Read the full DHCP explanation →

Consider the following DHCPv6 configuration on router R2:

ipv6 dhcp pool DHCP6_POOL dns-server 2001:db8::1 domain-name example.com !

interface GigabitEthernet0/0

ipv6 address 2001:db8:1::1/64 ipv6 dhcp server DHCP6_POOL ipv6 nd other-config-flag

no shutdown

What is the effect of this configuration?

A
Hosts on this subnet will use SLAAC to obtain their IPv6 address and then use DHCPv6 to get DNS and domain information.
The other-config-flag indicates that hosts should use SLAAC for addressing and DHCPv6 for additional parameters, which is stateless DHCPv6.
B
Hosts will obtain both their IPv6 address and DNS information from the DHCPv6 pool.
Why wrong: The other-config-flag means DHCPv6 is only for other configuration, not for address assignment. For address assignment, the managed-config-flag would be needed.
C
The DHCPv6 pool is missing the address prefix, so it will not provide any configuration to clients.
Why wrong: In stateless DHCPv6, the pool does not need an address prefix; it only provides other parameters like DNS and domain.
D
The ipv6 nd other-config-flag command is ignored because the DHCPv6 server is configured on the interface.
Why wrong: The flag is not ignored; it works together with the DHCPv6 server to provide stateless configuration.

Full breakdown with real-world context →

Question 2mediumdrag order

Study the full IPv6 explanation →

Drag and drop the steps to verify and validate IPv6 traffic filtering and uRPF operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 3mediummultiple choice

Study the full IPv6 explanation →

A network engineer runs the following command on Router R1:

R1# show ipv6 interface tunnel 0

Tunnel0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:2::1, subnet is 2001:DB8:2::/64 Joined group address(es): FF02::1 FF02::2 ICMP redirects are enabled ICMP unreachables are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds IPv6 uRPF: loose mode (allow default route)

Based on this output, what is the uRPF configuration on this interface?

A
uRPF is disabled
Why wrong: The output shows uRPF is enabled.
B
uRPF is enabled in strict mode
Why wrong: The output specifies loose mode, not strict.
C
uRPF is enabled in loose mode
The output confirms loose mode uRPF.
D
uRPF is enabled but only for IPv4
Why wrong: This is an IPv6 interface, and uRPF is configured for IPv6.

Full breakdown with real-world context →

Question 4mediummultiple choice

Study the full EIGRP explanation →

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

A
The ACL is blocking EIGRP query and reply packets, which are necessary for the EIGRP process to install routes.
Correct because EIGRP queries and replies are used to ensure route consistency and convergence; blocking them can prevent route installation.
B
The EIGRP router ID is not configured.
Why wrong: Incorrect because the neighbor relationship is established, indicating the router ID is valid.
C
The ACL is applied outbound, blocking the EIGRP updates from being sent.
Why wrong: Incorrect because the ACL is inbound, as stated.
D
The EIGRP for IPv6 is not enabled on the interface.
Why wrong: Incorrect because the neighbor relationship is established, meaning EIGRP is enabled.

Full breakdown with real-world context →

Question 5mediummultiple choice

Study the full IPv6 explanation →

Which IPv6 access-list entry will deny traffic from any source to the destination prefix 2001:db8:1::/48?

A
deny ipv6 any 2001:db8:1::/48
This correctly denies all IPv6 traffic from any source to the specified destination prefix.
B
deny ipv6 2001:db8:1::/48 any
Why wrong: This denies traffic from the specified source to any destination, which is the opposite of what is asked.
C
deny ipv6 any host 2001:db8:1::1
Why wrong: This denies traffic to a single host, not the /48 prefix.
D
deny ipv6 2001:db8:1::/48 2001:db8:1::/48
Why wrong: This denies traffic from the prefix to itself, which is not the intended behavior.

Full breakdown with real-world context →

Question 6hardmultiple choice

Study the full IPv6 explanation →

A DMVPN phase 3 network with IPv6 over IPv4 tunnels is experiencing spoke-to-spoke tunnel failures. Hub router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint ip nhrp network-id 1 ip nhrp map multicast dynamic ipv6 nhrp map multicast dynamic. Spoke router R2 shows: R2# show dmvpn detail Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete NHRP domain: 1 Interface: Tunnel0, IPv4 NHRP Details Type:Spoke, Total NBMA Peers: 1 # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb 1 192.0.2.2 2001:DB8:1::2 UP 00:10:00 D. What is the root cause?

A
The hub is missing the ip nhrp redirect command under Tunnel0.
This command enables NHRP redirect messages, which are essential for phase 3 spoke-to-spoke shortcut establishment.
B
The spoke is missing the ip nhrp shortcut command under Tunnel0.
Why wrong: While the spoke also needs this command, the hub's missing redirect is the primary cause here.
C
The tunnel mode should be gre multipoint on the spokes.
Why wrong: Spokes can use point-to-point GRE tunnels; multipoint is only required on the hub.
D
IPv6 NHRP is not supported on DMVPN phase 3.
Why wrong: IPv6 NHRP is supported on DMVPN phase 3 with appropriate configuration.

Full breakdown with real-world context →

Question 7mediummultiple choice

Study the full IPv6 explanation →

A network engineer runs the following command to verify IPv6 uRPF operation:

R1# show ipv6 interface GigabitEthernet0/0 | include verify

IPv6 verify source: strict

What does this output indicate?

A
Strict uRPF is enabled, so the router will drop packets if the source address is not in the routing table or if the best return path is not through the receiving interface.
Correct. Strict uRPF requires both a matching route and that the interface used to reach the source is the same as the receiving interface.
B
Strict uRPF is enabled, but it only checks if the source address is in the routing table, regardless of interface.
Why wrong: Incorrect. Strict uRPF checks both the route and the interface; loose uRPF only checks the route.
C
Loose uRPF is enabled, which only checks if the source address is in the routing table.
Why wrong: Incorrect. The output explicitly says 'strict'.
D
uRPF is disabled on this interface.
Why wrong: Incorrect. The output shows it is enabled with strict mode.

Full breakdown with real-world context →

Question 8mediummultiple choice

Study the full IPv6 explanation →

A network engineer runs the following command to troubleshoot an IPv6 traffic filtering issue:

R1# show ipv6 access-list FILTER

IPv6 access list FILTER

permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 2001:DB8:2::/48 any sequence

permit ipv6 any any sequence 30

What does this output indicate?

A
The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, but permit all other IPv6 traffic.
Correct. Sequence 10 permits the first prefix, sequence 20 denies the second, and sequence 30 permits everything else.
B
The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, and implicitly deny all other IPv6 traffic.
Why wrong: Incorrect. There is an explicit permit any any at sequence 30, so other traffic is permitted.
C
The access list will deny all traffic because of the deny statement.
Why wrong: Incorrect. The deny only applies to the specified prefix; other traffic is permitted by sequence 30.
D
The access list is invalid because IPv6 access lists require implicit deny at the end.
Why wrong: Incorrect. IPv6 access lists do have an implicit deny, but the explicit permit any any overrides it.

Full breakdown with real-world context →

Question 9easymultiple choice

Study the full IPv6 explanation →

Which IPv6 FHS feature uses a 'device tracking' database to maintain reachability information for hosts?

A
RA Guard
Why wrong: RA Guard does not maintain a device tracking database; it filters RAs.
B
DHCPv6 Guard
Why wrong: DHCPv6 Guard filters DHCPv6 messages and does not maintain a device tracking database.
C
Device Tracking
Correct. Device Tracking maintains a database of IPv6 addresses and their reachability.
D
PACL
Why wrong: PACL (Port ACL) is not a specific IPv6 FHS feature; it is a general ACL applied to a port.

Full breakdown with real-world context →

Question 10hardmultiple choice

Study the full EIGRP explanation →

A network engineer configures an IPv6 over IPv4 GRE tunnel with IPsec protection. The tunnel works for IPv6 traffic, but when the engineer tries to run EIGRP for IPv6 over the tunnel, the neighbor relationship forms but routes are not exchanged. The engineer checks the EIGRP configuration and sees that the tunnel interface is included in the EIGRP process. What is the most likely explanation?

A
EIGRP for IPv6 requires the 'no shutdown' command under the address-family; without it, the process is administratively down.
Unlike EIGRP for IPv4, EIGRP for IPv6 has a shutdown state by default. The 'no shutdown' command is required to activate the address-family.
B
The tunnel interface is not configured with 'ipv6 eigrp' under the interface.
Why wrong: The question states the interface is included in the EIGRP process, so this is not the issue.
C
The IPsec transform set does not allow multicast traffic, which EIGRP uses for hellos.
Why wrong: IPsec can encrypt multicast traffic; EIGRP hellos are sent to the multicast address FF02::A, which is encapsulated in the tunnel.
D
The GRE tunnel does not support EIGRP for IPv6; only OSPFv3 is supported.
Why wrong: GRE tunnels support any Layer 3 protocol, including EIGRP for IPv6.

Full breakdown with real-world context →

Question 11harddrag order

Study the full IPv6 explanation →

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 12mediummulti select

Study the full IPv6 explanation →

Which TWO statements about IPv6 Neighbor Discovery (ND) Inspection are true? (Choose TWO.)

A
It validates Neighbor Solicitation and Neighbor Advertisement messages against the IPv6 snooping binding table.
ND Inspection checks NS and NA messages against the binding table to prevent spoofing attacks.
B
It can be configured to rate-limit ND packets on a per-interface basis.
Rate-limiting is a key feature of ND Inspection to prevent DoS attacks using excessive ND messages.
C
It prevents rogue DHCPv6 servers from assigning malicious addresses.
Why wrong: This is the function of DHCPv6 Guard, not ND Inspection; ND Inspection focuses on ND messages, not DHCP.
D
It uses a prefix list to determine which source addresses are allowed.
Why wrong: ND Inspection uses the binding table, not a prefix list; prefix lists are used in other features like RA Guard.
E
It is enabled globally and cannot be applied on a per-interface basis.
Why wrong: ND Inspection is enabled per-interface using the 'ipv6 nd inspection' command, not just globally.

Full breakdown with real-world context →

Question 13mediumdrag order

Read the full DHCP explanation →

Drag and drop the steps to verify and validate DHCP (IPv4 and IPv6) operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14mediummulti select

Study the full ACL explanation →

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

A
IPv6 ACLs are applied to interfaces using the ipv6 traffic-filter command.
Correct: The command is 'ipv6 traffic-filter' in interface configuration mode.
B
IPv6 ACLs use wildcard masks similar to IPv4 ACLs.
Why wrong: IPv6 ACLs use prefix-length notation, not wildcard masks.
C
The implicit deny at the end of an IPv6 ACL also blocks ICMPv6 neighbor discovery messages.
Correct: The implicit deny applies to all traffic, including ND; you must explicitly permit necessary ND messages.
D
IPv6 ACLs automatically permit ICMPv6 neighbor discovery traffic by default.
Why wrong: There is no automatic permit; you must explicitly configure it.
E
IPv6 ACLs support the remark keyword for documentation.
Why wrong: The 'remark' keyword is not supported in classic IOS IPv6 ACLs (it is available in some IOS-XE versions, but not universally).

Full breakdown with real-world context →

Question 15mediummultiple choice

Study the full IPv6 explanation →

A network engineer runs the following command on Router R1:

R1# show ipv6 neighbors

IPv6 Address Age Link-layer Addr State Interface 2001:DB8:1::1 0 aaaa.bbbb.cccc REACH Gi0/0/0 2001:DB8:1::2 10 aaaa.bbbb.cccd STALE Gi0/0/0 2001:DB8:1::3 - aaaa.bbbb.ccce DELAY Gi0/0/1 FE80::1 0 aaaa.bbbb.cccf REACH Gi0/0/0

Based on this output, which statement is correct?

A
All neighbors are in a stable state.
Why wrong: The DELAY state indicates a transition; not all are stable.
B
The neighbor 2001:DB8:1::3 is in DELAY state, meaning a Neighbor Solicitation will be sent soon.
DELAY state means a NS is pending after a delay timer.
C
The neighbor 2001:DB8:1::2 is unreachable.
Why wrong: STALE state means the entry is valid but not recently verified.
D
The link-local address FE80::1 is not valid.
Why wrong: It is REACH, so it is valid.

Full breakdown with real-world context →

These 300-410 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 300-410 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

IPv6 Configuration Scenarios

How to approach ipv6 configuration scenarios

Quick answer

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

VPN Technologies practice questions

Infrastructure Security practice questions

Infrastructure Services practice questions

300-410 fundamentals practice questions

300-410 scenario practice questions

300-410 troubleshooting practice questions

Practice scenarios

Drag and drop the steps to verify and validate IPv6 traffic filtering and uRPF operational state into the correct order, from first to last.

Which IPv6 access-list entry will deny traffic from any source to the destination prefix 2001:db8:1::/48?

Which IPv6 FHS feature uses a 'device tracking' database to maintain reachability information for hosts?

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

Which TWO statements about IPv6 Neighbor Discovery (ND) Inspection are true? (Choose TWO.)

Drag and drop the steps to verify and validate DHCP (IPv4 and IPv6) operational state into the correct order, from first to last.

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)