easyMultiple Choice
350-401 Practice Question: Is configuring uRPF (unicast Reverse Path…
A network engineer is configuring uRPF (unicast Reverse Path Forwarding) on a Cisco router to prevent spoofed IP traffic. The engineer enables uRPF in strict mode on the ingress interface connected to the internal network. After enabling uRPF, legitimate traffic from internal hosts is being dropped. The engineer checks the routing table and sees that the routes for the internal subnets are present. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the misconception that uRPF only checks for the existence of a route in the routing table, but the trap here is that strict mode additionally requires the incoming interface to match the outgoing interface for the source IP's return path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The return route for the source IP points to a different interface than the one where the packet arrived.
In strict uRPF mode, the router checks that the source IP address of an incoming packet is reachable via the same interface on which the packet arrived. Even if the route for the source subnet exists in the routing table, if the best return route points to a different interface (e.g., a backup link or a different path), the packet will be dropped. This is the most common cause of legitimate traffic being dropped after enabling strict uRPF.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The return route for the source IP points to a different interface than the one where the packet arrived.
Why this is correct
Strict Unicast Reverse Path Forwarding validates the source address of a packet by performing a reverse lookup in the FIB. If the best route to the source IP is not via the same interface that received the packet, the router drops it. This prevents spoofed traffic where an attacker sends packets with a source address that would legitimately arrive on a different interface, ensuring asymmetric routing paths or forged addresses are rejected.
- ✗
uRPF is checking the destination IP address, which is not reachable.
Why it's wrong here
uRPF is designed to validate the source address, not the destination. It performs a FIB lookup using the source IP as the destination of the return path, ensuring that the packet's source is topologically reachable from the ingress interface. Destination reachability is irrelevant to uRPF; packet forwarding decisions are made separately by the normal destination-based lookup.
- ✗
The router does not have a default route, so uRPF drops all traffic.
Why it's wrong here
uRPF does not require a default route; it requires a FIB entry for the source address, which can be a specific route, a connected network, or a default route depending on configuration. Even without a default route, uRPF will permit packets whose source address has a specific route pointing back out the same interface. Conversely, the presence of a default route does not guarantee acceptance if the default route points out a different interface or if strict mode requires an exact match.
- ✗
uRPF cannot be used with static routes; it requires a dynamic routing protocol.
Why it's wrong here
Unicast Reverse Path Forwarding is independent of the routing protocol used to populate the FIB. It works with static routes, directly connected routes, dynamic routing protocol routes (OSPF, EIGRP, BGP), and even default routes. The only requirement is that a valid route to the source prefix exists in the FIB pointing back to the ingress interface; how that route was learned is irrelevant.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.