IPv6 Traffic Filtering and uRPF practice questions

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer is troubleshooting a connectivity issue between two routers R1 and R2 connected via GigabitEthernet0/0. The engineer notices that R1 can ping its own IPv6 address 2001:db8:1::1/64, but cannot ping R2's interface address 2001:db8:1::2/64. The output of 'show ipv6 interface GigabitEthernet0/0' on R1 indicates that IPv6 is enabled and the interface is up/up. The engineer checks the access list applied to the interface and sees an inbound IPv6 ACL that permits only ICMPv6 echo requests from a specific source. What is the most likely cause of the ping failure?

Trap 1: The ACL is applied outbound on R1 and blocks the echo request.

Incorrect because the ACL is applied inbound, not outbound.

Trap 2: IPv6 unicast-routing is not enabled on R1.

Incorrect because R1 can ping its own address, indicating IPv6 is operational; unicast-routing is not required for direct link pings.

Trap 3: The ACL is missing a permit statement for IPv6 neighbor discovery…

Incorrect because ND messages are needed for address resolution, but the symptom is a ping failure after ND has likely succeeded (R1 can ping its own address, implying layer 2 is up).

A
The ACL is applied inbound on R1 and does not permit ICMPv6 echo replies from R2.
Correct because ICMPv6 echo replies are sourced from the destination address (R2) and must be permitted inbound on R1 for the ping to succeed.
B
The ACL is applied outbound on R1 and blocks the echo request.
Why wrong: Incorrect because the ACL is applied inbound, not outbound.
C
IPv6 unicast-routing is not enabled on R1.
Why wrong: Incorrect because R1 can ping its own address, indicating IPv6 is operational; unicast-routing is not required for direct link pings.
D
The ACL is missing a permit statement for IPv6 neighbor discovery (ND) messages.
Why wrong: Incorrect because ND messages are needed for address resolution, but the symptom is a ping failure after ND has likely succeeded (R1 can ping its own address, implying layer 2 is up).

Open the full BGP breakdown →

Question 2hardmultiple choice

A network engineer is troubleshooting a BGP IPv6 peering issue between two routers, R1 and R2, connected via a point-to-point link. The engineer notices that the BGP session is flapping with error 'BGP Notification sent: 3/2 (Update malformed)'. The engineer checks the IPv6 ACL applied to the interface on R1 and sees an inbound ACL that permits only TCP port 179 from the neighbor's link-local address. The BGP peering uses the global unicast addresses of the interfaces. What is the most likely cause of the BGP session failure?

Trap 1: The BGP update is malformed because the neighbor does not have the…

Incorrect because the error message is likely caused by the ACL dropping packets, not a malformed update; the update is never received.

Trap 2: The ACL is missing a permit statement for ICMPv6 neighbor discovery…

Incorrect because ND messages are not directly related to BGP TCP connections; the issue is TCP port 179.

Trap 3: The BGP session is using link-local addresses, but the ACL permits…

Incorrect because the scenario states the peering uses global unicast addresses.

Study all IPv6 Traffic Filtering and uRPF common traps →

A
The ACL is blocking TCP packets from the neighbor's global unicast address because it only permits traffic from the link-local address.
Correct because BGP uses TCP, and the ACL permits only traffic from the link-local address, but the BGP session is established using global addresses, causing the TCP handshake to fail.
B
The BGP update is malformed because the neighbor does not have the correct route-map applied.
Why wrong: Incorrect because the error message is likely caused by the ACL dropping packets, not a malformed update; the update is never received.
C
The ACL is missing a permit statement for ICMPv6 neighbor discovery messages.
Why wrong: Incorrect because ND messages are not directly related to BGP TCP connections; the issue is TCP port 179.
D
The BGP session is using link-local addresses, but the ACL permits global addresses.
Why wrong: Incorrect because the scenario states the peering uses global unicast addresses.

Review the full OSPF breakdown →

Question 3mediummultiple choice

A network engineer is troubleshooting an IPv6 routing issue on a router that is receiving OSPFv3 routes from multiple neighbors. The engineer notices that some routes are missing from the routing table. The engineer checks the interface configuration and finds an inbound IPv6 ACL applied to the interface that permits only specific prefixes. The engineer also notices that the missing routes are from a neighbor that is sending routes with a prefix length of /48, while the ACL permits only /64 prefixes. What is the most likely cause of the missing routes?

Trap 1: The OSPFv3 neighbor relationship is down due to a mismatched area…

Incorrect because the neighbor is sending routes, indicating the adjacency is up.

Trap 2: The router has a route-map that is denying the /48 routes before…

Incorrect because the symptom is specifically related to the ACL on the interface, not a route-map.

Trap 3: The IPv6 ACL is applied outbound, blocking the routes from being…

Incorrect because the ACL is applied inbound, as stated in the scenario.

Study all IPv6 Traffic Filtering and uRPF common traps →

A
The ACL is filtering the OSPFv3 routes based on prefix length, and the /48 routes are not permitted.
Correct because the ACL permits only /64 prefixes, so /48 routes are dropped, preventing them from being installed in the routing table.
B
The OSPFv3 neighbor relationship is down due to a mismatched area ID.
Why wrong: Incorrect because the neighbor is sending routes, indicating the adjacency is up.
C
The router has a route-map that is denying the /48 routes before they are installed.
Why wrong: Incorrect because the symptom is specifically related to the ACL on the interface, not a route-map.
D
The IPv6 ACL is applied outbound, blocking the routes from being sent.
Why wrong: Incorrect because the ACL is applied inbound, as stated in the scenario.

Open the full VLAN trunking answer →

Question 4hardmultiple choice

A network engineer is troubleshooting a connectivity issue where a host on VLAN 10 cannot reach a server on VLAN 20. Both VLANs are on the same switch, which is running IPv6. The engineer checks the switch and finds that uRPF (unicast Reverse Path Forwarding) is enabled in strict mode on the VLAN 20 interface. The host's IPv6 address is 2001:db8:10::100/64, and the server's address is 2001:db8:20::200/64. The switch has a default route pointing to a next-hop router. The host sends traffic to the server, but the switch drops the packets. What is the most likely cause?

Trap 1: The uRPF mode should be loose mode to allow traffic from any source…

Incorrect because loose mode would still require a route to the source, but a default route would satisfy loose mode; however, the scenario indicates strict mode is the issue.

Trap 2: The host's IPv6 address is not in the switch's neighbor cache.

Incorrect because uRPF checks the routing table, not the neighbor cache.

Trap 3: The switch has an ACL that blocks traffic between VLANs.

Incorrect because the symptom is specifically related to uRPF, not an ACL.

Study all IPv6 Traffic Filtering and uRPF common traps →

A
The uRPF strict mode check fails because the switch does not have a specific route to the host's subnet pointing back to the VLAN 10 interface.
Correct because uRPF strict mode requires a matching route in the FIB that points to the same interface on which the packet was received; a default route does not satisfy this requirement.
B
The uRPF mode should be loose mode to allow traffic from any source as long as there is a route in the FIB.
Why wrong: Incorrect because loose mode would still require a route to the source, but a default route would satisfy loose mode; however, the scenario indicates strict mode is the issue.
C
The host's IPv6 address is not in the switch's neighbor cache.
Why wrong: Incorrect because uRPF checks the routing table, not the neighbor cache.
D
The switch has an ACL that blocks traffic between VLANs.
Why wrong: Incorrect because the symptom is specifically related to uRPF, not an ACL.

Study the full EIGRP explanation →

Question 5mediummultiple choice

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

Trap 1: The EIGRP router ID is not configured.

Incorrect because the neighbor relationship is established, indicating the router ID is valid.

Trap 2: The ACL is applied outbound, blocking the EIGRP updates from being…

Incorrect because the ACL is inbound, as stated.

Trap 3: The EIGRP for IPv6 is not enabled on the interface.

Incorrect because the neighbor relationship is established, meaning EIGRP is enabled.

Study all IPv6 Traffic Filtering and uRPF common traps →

A
The ACL is blocking EIGRP query and reply packets, which are necessary for the EIGRP process to install routes.
Correct because EIGRP queries and replies are used to ensure route consistency and convergence; blocking them can prevent route installation.
B
The EIGRP router ID is not configured.
Why wrong: Incorrect because the neighbor relationship is established, indicating the router ID is valid.
C
The ACL is applied outbound, blocking the EIGRP updates from being sent.
Why wrong: Incorrect because the ACL is inbound, as stated.
D
The EIGRP for IPv6 is not enabled on the interface.
Why wrong: Incorrect because the neighbor relationship is established, meaning EIGRP is enabled.

Question 6mediummultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer is troubleshooting a scenario where a router is dropping IPv6 packets that are destined for a server on a directly connected network. The engineer checks the interface and finds that uRPF is enabled in loose mode. The router has a default route pointing to an upstream router. The source address of the packets is 2001:db8:100::1, which is not in the routing table (the router has no route to that prefix). What is the most likely cause of the packet drops?

Trap 1: The uRPF loose mode check fails because the source address is not…

Incorrect because loose mode does not require the same interface; it only requires any route.

Trap 2: The router has an ACL that blocks traffic from that source.

Incorrect because the symptom is specifically related to uRPF, not an ACL.

Trap 3: The uRPF mode should be strict mode to allow the traffic.

Incorrect because strict mode would also drop the packet if the route does not point back to the same interface.

A
The uRPF loose mode check fails because there is no route to the source address in the routing table.
Correct because loose mode requires at least one route to the source address in the FIB; if no route exists, the packet is dropped.
B
The uRPF loose mode check fails because the source address is not reachable via the same interface.
Why wrong: Incorrect because loose mode does not require the same interface; it only requires any route.
C
The router has an ACL that blocks traffic from that source.
Why wrong: Incorrect because the symptom is specifically related to uRPF, not an ACL.
D
The uRPF mode should be strict mode to allow the traffic.
Why wrong: Incorrect because strict mode would also drop the packet if the route does not point back to the same interface.

Question 7hardmultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer is troubleshooting an IPv6 multicast issue on a router. The router is receiving multicast traffic from a source, but the traffic is not being forwarded to downstream receivers. The engineer checks the interface and finds an inbound IPv6 ACL that permits only certain multicast groups. The ACL permits the group address FF1E::1, but the source address is 2001:db8:1::1. The engineer also notices that uRPF is enabled on the interface in strict mode. The router has a route to the source's network via a different interface. What is the most likely cause of the multicast forwarding failure?

Trap 1: The ACL is blocking the multicast traffic because the source…

Incorrect because the ACL permits the group address, and the source address is not typically filtered in multicast ACLs unless specified.

Trap 2: The multicast routing is not enabled globally.

Incorrect because the router is receiving multicast traffic, indicating multicast routing is enabled.

Trap 3: The downstream receivers are not in the multicast group.

Incorrect because the issue is with forwarding, not group membership.

A
The uRPF strict mode check fails because the route to the source's network points out a different interface than the one on which the multicast packet was received.
Correct because multicast uRPF requires the source address to be reachable via the receiving interface; otherwise, the packet is dropped to prevent spoofing.
B
The ACL is blocking the multicast traffic because the source address is not permitted.
Why wrong: Incorrect because the ACL permits the group address, and the source address is not typically filtered in multicast ACLs unless specified.
C
The multicast routing is not enabled globally.
Why wrong: Incorrect because the router is receiving multicast traffic, indicating multicast routing is enabled.
D
The downstream receivers are not in the multicast group.
Why wrong: Incorrect because the issue is with forwarding, not group membership.

Question 8hardmultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is using a tunnel interface (IPv6 over IPv4). The engineer notices that traffic is not passing through the tunnel. The engineer checks the tunnel interface and finds an inbound IPv6 ACL that permits only certain IPv6 traffic. The engineer also sees that uRPF is enabled on the tunnel interface in strict mode. The tunnel source and destination are IPv4 addresses. The IPv6 traffic sourced from a network behind the tunnel is being dropped. What is the most likely cause?

Trap 1: The ACL is blocking the IPv6 traffic because the tunnel interface…

Incorrect because ACLs can be applied to tunnel interfaces.

Trap 2: The tunnel is not configured with the correct IPv4 source and…

Incorrect because the tunnel is up and traffic is being received, indicating the tunnel configuration is correct.

Trap 3: The uRPF mode should be loose mode to allow traffic from any source.

Incorrect because loose mode would still require a route to the source, but the issue is the route pointing to the tunnel interface; loose mode might work if there is any route, but the scenario implies strict mode is the problem.

A
The uRPF strict mode check fails because the router does not have a route to the source IPv6 network pointing to the tunnel interface.
Correct because uRPF on a tunnel requires a route to the source via the tunnel interface; without it, the packet is dropped.
B
The ACL is blocking the IPv6 traffic because the tunnel interface does not support ACLs.
Why wrong: Incorrect because ACLs can be applied to tunnel interfaces.
C
The tunnel is not configured with the correct IPv4 source and destination.
Why wrong: Incorrect because the tunnel is up and traffic is being received, indicating the tunnel configuration is correct.
D
The uRPF mode should be loose mode to allow traffic from any source.
Why wrong: Incorrect because loose mode would still require a route to the source, but the issue is the route pointing to the tunnel interface; loose mode might work if there is any route, but the scenario implies strict mode is the problem.

Review the full OSPF breakdown →

Question 9easymultiple choice

A network engineer is troubleshooting an IPv6 routing issue where a router is not learning routes from an OSPFv3 neighbor. The engineer checks the interface and finds an inbound IPv6 ACL that permits only OSPFv3 packets with a specific area ID in the packet. The ACL is using the 'ospfv3' keyword to match packets. The engineer also notices that the OSPFv3 neighbor is in a different area. What is the most likely cause of the route learning failure?

Trap 1: The OSPFv3 process is not configured with the correct router ID.

Incorrect because the neighbor relationship is not forming due to the ACL, not the router ID.

Trap 2: The interface is not enabled for OSPFv3.

Incorrect because the neighbor is sending packets, indicating OSPFv3 is enabled on the interface.

Trap 3: The ACL is applied outbound, blocking the OSPFv3 packets from being…

Incorrect because the ACL is inbound, as stated.

Study all IPv6 Traffic Filtering and uRPF common traps →

A
The ACL is dropping OSPFv3 packets from the neighbor because they contain a different area ID than what the ACL permits.
Correct because the ACL permits only packets with a specific area ID, and the neighbor is in a different area, so its packets are dropped.
B
The OSPFv3 process is not configured with the correct router ID.
Why wrong: Incorrect because the neighbor relationship is not forming due to the ACL, not the router ID.
C
The interface is not enabled for OSPFv3.
Why wrong: Incorrect because the neighbor is sending packets, indicating OSPFv3 is enabled on the interface.
D
The ACL is applied outbound, blocking the OSPFv3 packets from being sent.
Why wrong: Incorrect because the ACL is inbound, as stated.

Question 10mediummultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0

GigabitEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64 Joined group address(es): FF02::1 FF02::2 ICMP redirects are enabled ICMP unreachables are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 1000 milliseconds ND router advertisements are sent every 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses. IPv6 uRPF: strict mode (drop invalid packets)

Based on this output, what is the operational state of uRPF on this interface?

Trap 1: uRPF is disabled

The output explicitly shows uRPF is enabled.

Trap 2: uRPF is enabled in loose mode

The output specifies strict mode, not loose.

Trap 3: uRPF is enabled but only for multicast

uRPF applies to unicast traffic, not specifically multicast.

A
uRPF is disabled
Why wrong: The output explicitly shows uRPF is enabled.
B
uRPF is enabled in strict mode
The output confirms strict mode uRPF is active.
C
uRPF is enabled in loose mode
Why wrong: The output specifies strict mode, not loose.
D
uRPF is enabled but only for multicast
Why wrong: uRPF applies to unicast traffic, not specifically multicast.

Question 11mediummultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer runs the following command on Router R1:

R1# show ipv6 interface tunnel 0

Tunnel0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:2::1, subnet is 2001:DB8:2::/64 Joined group address(es): FF02::1 FF02::2 ICMP redirects are enabled ICMP unreachables are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds IPv6 uRPF: loose mode (allow default route)

Based on this output, what is the uRPF configuration on this interface?

Trap 1: uRPF is disabled

The output shows uRPF is enabled.

Trap 2: uRPF is enabled in strict mode

The output specifies loose mode, not strict.

Trap 3: uRPF is enabled but only for IPv4

This is an IPv6 interface, and uRPF is configured for IPv6.

A
uRPF is disabled
Why wrong: The output shows uRPF is enabled.
B
uRPF is enabled in strict mode
Why wrong: The output specifies loose mode, not strict.
C
uRPF is enabled in loose mode
The output confirms loose mode uRPF.
D
uRPF is enabled but only for IPv4
Why wrong: This is an IPv6 interface, and uRPF is configured for IPv6.

Question 12easymultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list FILTER-IPv6

IPv6 access list FILTER-IPv6

permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 any any sequence 20

Based on this output, what is the effect of this access list when applied to an interface?

Trap 1: It permits all IPv6 traffic

Only traffic from the specified prefix is permitted; other traffic is denied.

Trap 2: It denies all IPv6 traffic from 2001:DB8:1::/48

The first line permits that prefix.

Trap 3: It permits all IPv6 traffic except from 2001:DB8:1::/48

The ACL does the opposite – it permits that prefix and denies all else.

A
It permits all IPv6 traffic
Why wrong: Only traffic from the specified prefix is permitted; other traffic is denied.
B
It denies all IPv6 traffic from 2001:DB8:1::/48
Why wrong: The first line permits that prefix.
C
It permits only IPv6 traffic from 2001:DB8:1::/48 and denies everything else
Sequence 10 permits the prefix, sequence 20 denies all other traffic.
D
It permits all IPv6 traffic except from 2001:DB8:1::/48
Why wrong: The ACL does the opposite – it permits that prefix and denies all else.

Question 13mediummultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF

IPv6 uRPF: strict mode

Based on this output, which statement is true?

Trap 1: uRPF is disabled

The output clearly shows uRPF is enabled.

Trap 2: uRPF is enabled in loose mode

The output specifies strict mode.

Trap 3: uRPF is enabled but only for multicast

uRPF applies to unicast traffic.

A
uRPF is disabled
Why wrong: The output clearly shows uRPF is enabled.
B
uRPF is enabled in strict mode
The output confirms strict mode uRPF.
C
uRPF is enabled in loose mode
Why wrong: The output specifies strict mode.
D
uRPF is enabled but only for multicast
Why wrong: uRPF applies to unicast traffic.

Question 14mediummultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF

IPv6 uRPF: loose mode

Based on this output, what is the operational state of uRPF on this interface?

Trap 1: uRPF is disabled

The output shows uRPF is enabled.

Trap 2: uRPF is enabled in strict mode

The output specifies loose mode.

Trap 3: uRPF is enabled but only for IPv4

This is an IPv6 interface, and uRPF is configured for IPv6.

A
uRPF is disabled
Why wrong: The output shows uRPF is enabled.
B
uRPF is enabled in strict mode
Why wrong: The output specifies loose mode.
C
uRPF is enabled in loose mode
The output confirms loose mode uRPF.
D
uRPF is enabled but only for IPv4
Why wrong: This is an IPv6 interface, and uRPF is configured for IPv6.

Question 15easymultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list DENY-REMOTE

IPv6 access list DENY-REMOTE

deny ipv6 2001:DB8:2::/48 any sequence 10
    permit ipv6 any any sequence 20

Based on this output, what is the effect of this access list when applied to an interface?

Trap 1: It permits all IPv6 traffic

Traffic from the specified prefix is denied.

Trap 2: It permits only IPv6 traffic from 2001:DB8:2::/48

The ACL does the opposite – it denies that prefix.

Trap 3: It denies all IPv6 traffic

Only traffic from the specified prefix is denied; other traffic is permitted.

A
It permits all IPv6 traffic
Why wrong: Traffic from the specified prefix is denied.
B
It denies all IPv6 traffic from 2001:DB8:2::/48 and permits everything else
Sequence 10 denies the prefix, sequence 20 permits all other traffic.
C
It permits only IPv6 traffic from 2001:DB8:2::/48
Why wrong: The ACL does the opposite – it denies that prefix.
D
It denies all IPv6 traffic
Why wrong: Only traffic from the specified prefix is denied; other traffic is permitted.

Question 16mediummultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF

IPv6 uRPF: strict mode (allow default route)

Based on this output, what is the uRPF configuration on this interface?

Trap 1: uRPF is disabled

The output shows uRPF is enabled.

Trap 2: uRPF is enabled in loose mode

The output specifies strict mode.

Trap 3: uRPF is enabled but only for multicast

uRPF applies to unicast traffic.

A
uRPF is disabled
Why wrong: The output shows uRPF is enabled.
B
uRPF is enabled in strict mode with allow-default
The output confirms strict mode uRPF with the allow-default option.
C
uRPF is enabled in loose mode
Why wrong: The output specifies strict mode.
D
uRPF is enabled but only for multicast
Why wrong: uRPF applies to unicast traffic.

Question 17hardmultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0

Based on this output, which two features are configured on this interface?

Trap 1: uRPF in loose mode and outbound IPv6 ACL

uRPF is strict, and the ACL is inbound.

Trap 2: uRPF disabled and inbound IPv6 ACL

uRPF is enabled.

Trap 3: uRPF in strict mode and outbound IPv6 ACL

The ACL is inbound.

A
uRPF in strict mode and inbound IPv6 ACL
Both are clearly shown in the output.
B
uRPF in loose mode and outbound IPv6 ACL
Why wrong: uRPF is strict, and the ACL is inbound.
C
uRPF disabled and inbound IPv6 ACL
Why wrong: uRPF is enabled.
D
uRPF in strict mode and outbound IPv6 ACL
Why wrong: The ACL is inbound.

Question 18mediummultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list PERMIT-ONLY

IPv6 access list PERMIT-ONLY

permit ipv6 2001:DB8:3::/48 any sequence 10

Based on this output, what is the effect of this access list when applied to an interface?

Trap 1: It permits all IPv6 traffic

Only traffic from the specified prefix is permitted; other traffic is implicitly denied.

Trap 2: It denies all IPv6 traffic from 2001:DB8:3::/48

The ACL permits that prefix.

Trap 3: It permits all IPv6 traffic except from 2001:DB8:3::/48

The ACL does the opposite – it permits that prefix and denies all else.

A
It permits all IPv6 traffic
Why wrong: Only traffic from the specified prefix is permitted; other traffic is implicitly denied.
B
It permits only IPv6 traffic from 2001:DB8:3::/48 and denies everything else
The permit statement allows the prefix, and the implicit deny denies all other traffic.
C
It denies all IPv6 traffic from 2001:DB8:3::/48
Why wrong: The ACL permits that prefix.
D
It permits all IPv6 traffic except from 2001:DB8:3::/48
Why wrong: The ACL does the opposite – it permits that prefix and denies all else.

Question 19mediummultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

Examine the following IPv6 ACL applied to an interface:

ipv6 access-list FILTER

permit ipv6 any any fragments
 deny ipv6 any any

interface GigabitEthernet0/1

ipv6 traffic-filter FILTER in

What is the effect of this configuration?

Trap 1: All IPv6 traffic is permitted because the permit statement matches…

The 'fragments' keyword matches only non-initial fragments; initial and non-fragmented packets are not matched by this entry.

Trap 2: The ACL is invalid because 'fragments' cannot be used with 'any…

The 'fragments' keyword is valid with IPv6 ACLs and can be used with any source/destination.

Trap 3: The interface command is missing the 'ipv6 enable' prerequisite.

The 'ipv6 traffic-filter' command does not require 'ipv6 enable' on the interface; it works as long as IPv6 is configured.

A
All IPv6 traffic is permitted because the permit statement matches any packet.
Why wrong: The 'fragments' keyword matches only non-initial fragments; initial and non-fragmented packets are not matched by this entry.
B
Only fragmented IPv6 packets are permitted; all other IPv6 traffic is denied.
The first ACE permits only fragments; the second denies everything else, so only fragments pass.
C
The ACL is invalid because 'fragments' cannot be used with 'any any'.
Why wrong: The 'fragments' keyword is valid with IPv6 ACLs and can be used with any source/destination.
D
The interface command is missing the 'ipv6 enable' prerequisite.
Why wrong: The 'ipv6 traffic-filter' command does not require 'ipv6 enable' on the interface; it works as long as IPv6 is configured.

Question 20mediummultiple choice

Study all IPv6 Traffic Filtering and uRPF common traps →

Consider the following configuration:

ipv6 access-list BLOCK-ICMP

deny icmp any any echo-request
 deny icmp any any echo-reply
 permit ipv6 any any

interface GigabitEthernet0/2

ipv6 traffic-filter BLOCK-ICMP in

Which statement is true?

Trap 1: The ACL blocks all ICMPv6 traffic because the deny statements are…

Only echo-request and echo-reply are denied; other ICMP types (e.g., neighbor solicitation) are permitted.

Trap 2: The ACL must be applied outbound to filter echo-request.

Inbound filtering is correct; echo-request arriving on the interface will be matched.

Trap 3: The ACL is missing the 'log' keyword to be effective.

The 'log' keyword is optional and not required for the ACL to function.

A
The ACL blocks ICMP echo-request and echo-reply, but permits all other IPv6 traffic inbound.
The deny statements match the specified ICMP types; the final permit allows everything else.
B
The ACL blocks all ICMPv6 traffic because the deny statements are too broad.
Why wrong: Only echo-request and echo-reply are denied; other ICMP types (e.g., neighbor solicitation) are permitted.
C
The ACL must be applied outbound to filter echo-request.
Why wrong: Inbound filtering is correct; echo-request arriving on the interface will be matched.
D
The ACL is missing the 'log' keyword to be effective.
Why wrong: The 'log' keyword is optional and not required for the ACL to function.