hardMultiple Choice
300-410 VRF-lite Practice Question
Router R1 has an ACL applied to interface Gig0/0 in VRF-A that permits only specific management traffic. The ACL is: access-list 100 permit udp any any eq snmp, access-list 100 permit tcp any any eq ssh, access-list 100 deny ip any any. The router's SNMP and SSH services are configured globally. Management stations in the global table cannot reach the router's VRF interface IP. What is the root cause?
⚠ Common exam trap
300-410 often tests VRF awareness and the misconception that ACLs alone control access, overlooking the fundamental routing isolation between VRFs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The management station must be in the same VRF.
The root cause is that the management station must be in the same VRF as the router's VRF interface to reach it. The ACL permits SNMP and SSH traffic, but if the management station is in the global routing table and the interface is in VRF-A, the traffic cannot be routed to the VRF interface without proper VRF leaking or route targets. Thus, the management station needs to be in the same VRF (or there must be VRF route leaking) for connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ACL does not permit the source IP address of the management station, causing traffic to be denied.
Why it's wrong here
The ACL permits SNMP and SSH from any source, so the management station's address is not being denied. Explicit source permits are needed when locking management access to specific stations, but that restriction is not what blocks this traffic.
- ✗
The ACL should be applied outbound on the VRF interface.
Why it's wrong here
Applying the ACL outbound filters traffic leaving the VRF interface, not the inbound management requests arriving at it. Outbound ACLs are correct when controlling traffic the router originates or forwards outward, not for filtering inbound SNMP and SSH destined to the interface.
- ✓
The management station must be in the same VRF.
Why this is correct
Correct. In VRF-Lite, by default, there is no inter-VRF routing. Management stations in the global table cannot reach a VRF interface IP unless route leaking is configured or the station is placed in the same VRF.
- ✗
The ACL is missing a permit statement for the management station's source IP.
Why it's wrong here
The ACL already permits SNMP and SSH from any source, so a source-IP permit changes nothing. Source-specific permits matter when management access must be restricted to known stations, but here the deny is not the cause of the failure.
Visual reference
Go deeper
Related to this question
Learn chapter
Device Management and Network Monitoring (SNMP, Syslog, NetFlow)
Key term
MPLS Layer 3 VPN
A technology that uses Multiprotocol Label Switching to create secure, scalable virtual private networks that connect multiple sites at the network layer, where the service provider manages routing between customer sites.
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.