Question 1,793 of 2,152

IPv6 Traffic Filtering and uRPF →hardMultiple ChoiceObjective-mapped

OSPFv3 Adjacency Failure — IPv6 ACL Filtering OSPFv3 Protocol

This 300-410 practice question tests your understanding of ipv6 traffic filtering and urpf. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

An engineer configures an IPv6 ACL to filter OSPFv3 traffic on a router interface. The ACL includes a deny entry for OSPFv3 (protocol 89) followed by a permit ipv6 any any. However, OSPFv3 adjacencies still fail to form over that interface. Which is the most likely explanation?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

A
The ACL is applied outbound, but OSPFv3 packets are generated locally and are not subject to outbound ACL filtering.
Correct. Outbound ACLs do not filter locally generated packets, including OSPFv3 Hellos. The ACL must be applied inbound to filter incoming OSPFv3 packets.
B
The ACL uses 'deny ospf' but OSPFv3 uses protocol 89, which is not matched by 'deny ospf' in IPv6 ACLs.
Why wrong: Incorrect. 'deny ospf' in IPv6 ACLs correctly matches OSPFv3 (protocol 89).
C
The ACL must include a permit entry for the link-local address of the neighbor, otherwise OSPFv3 packets are dropped.
Why wrong: Incorrect. ACLs can match on source/destination addresses, but OSPFv3 uses link-local addresses; if the ACL permits ipv6 any any, it includes link-local.
D
The ACL is applied to the interface but the router has 'ipv6 ospf authentication' configured, which changes the packet format and bypasses ACL filtering.
Why wrong: Incorrect. Authentication does not bypass ACL filtering; ACLs are applied before authentication processing.

Full breakdown with real-world context →

Quick Answer

The answer is that the ACL is applied outbound, but OSPFv3 packets are generated locally by the router and are not subject to outbound ACL filtering. In Cisco IOS, outbound ACLs only filter traffic that is routed through the interface, not traffic originated by the router itself, such as OSPFv3 hello packets sent to the multicast addresses ff02::5 and ff02::6. This is a common trap on the CCNP ENARSI 300-410 exam, where candidates assume an outbound ACL will block locally generated protocol traffic, but the router’s control plane bypasses outbound interface ACLs entirely. To filter OSPFv3 adjacency formation, the ACL must be applied inbound on the receiving interface, and it must correctly match protocol 89 using the `deny ospf` keyword rather than a numeric protocol number. Memory tip: think “local out, no doubt” — locally originated packets ignore outbound ACLs, so always apply the filter inbound to block OSPFv3.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The ACL is applied outbound, but OSPFv3 packets are generated locally and are not subject to outbound ACL filtering.

Option A is correct because OSPFv3 packets are generated by the router's own control plane (the OSPF process) and are not subject to outbound ACL filtering on the interface. Outbound ACLs only filter packets that are being forwarded through the interface, not packets originated by the router itself. Since the ACL is applied outbound, the deny entry for protocol 89 never applies to locally generated OSPFv3 hello packets, so they are sent out, but the inbound side of the neighbor might still be blocked or the adjacency fails due to other reasons—but the core issue here is that outbound ACLs do not filter locally originated traffic.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The ACL is applied outbound, but OSPFv3 packets are generated locally and are not subject to outbound ACL filtering.
Why this is correct
Correct. Outbound ACLs do not filter locally generated packets, including OSPFv3 Hellos. The ACL must be applied inbound to filter incoming OSPFv3 packets.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The ACL uses 'deny ospf' but OSPFv3 uses protocol 89, which is not matched by 'deny ospf' in IPv6 ACLs.
Why it's wrong here
Incorrect. 'deny ospf' in IPv6 ACLs correctly matches OSPFv3 (protocol 89).
✗
The ACL must include a permit entry for the link-local address of the neighbor, otherwise OSPFv3 packets are dropped.
Why it's wrong here
Incorrect. ACLs can match on source/destination addresses, but OSPFv3 uses link-local addresses; if the ACL permits ipv6 any any, it includes link-local.
✗
The ACL is applied to the interface but the router has 'ipv6 ospf authentication' configured, which changes the packet format and bypasses ACL filtering.
Why it's wrong here
Incorrect. Authentication does not bypass ACL filtering; ACLs are applied before authentication processing.

Common exam traps

Common exam trap: answer the scenario, not the keyword

Cisco often tests the distinction between locally generated traffic and transit traffic with respect to outbound ACLs, and the trap here is that candidates assume outbound ACLs filter all traffic leaving the interface, including control plane packets like OSPFv3 hellos.

Detailed technical explanation

How to think about this question

In Cisco IOS, outbound ACLs on an interface only filter packets that are routed through the interface (transit traffic). Locally generated packets, such as OSPFv3 hellos, routing updates, or pings from the router itself, are not subject to outbound ACLs; they are only filtered by inbound ACLs on the outgoing interface if applied inbound. This behavior is consistent with the concept that ACLs are applied to the data plane forwarding path, not the control plane origination path. A real-world scenario is when an engineer applies an outbound ACL to block OSPF on a WAN interface but wonders why adjacencies still form—this is the exact trap.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A network engineer at a university connects two campus buildings via a fibre link. Both routers run OSPF, but no adjacency forms — even though both routers can ping each other. The engineer finds one router is in area 0 and the other in area 1. OSPF adjacency requires matching area numbers, hello/dead timers, and network type. IP reachability alone is not enough.

Visual reference

Quick reference

Routing Protocol Comparison

Protocol	Metric	Max Hops	Algorithm	Type
RIP v2	Hop count	15	Bellman-Ford	Distance vector
OSPF	Cost (bandwidth)	Unlimited	Dijkstra (SPF)	Link state
EIGRP	Composite metric	Unlimited	DUAL	Hybrid
IS-IS	Cost	Unlimited	Dijkstra	Link state
BGP	Policy / attributes	Unlimited	Path vector	Path vector

RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related 300-410 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Layer 3 Technologies practice questions

Practise 300-410 questions linked to Layer 3 Technologies.

EIGRP Troubleshooting practice questions

Practise 300-410 questions linked to EIGRP Troubleshooting.

OSPF Troubleshooting (v2/v3) practice questions

Practise 300-410 questions linked to OSPF Troubleshooting (v2/v3).

BGP Troubleshooting practice questions

Practise 300-410 questions linked to BGP Troubleshooting.

Route Redistribution practice questions

Practise 300-410 questions linked to Route Redistribution.

Policy-Based Routing (PBR) practice questions

Practise 300-410 questions linked to Policy-Based Routing (PBR).

VRF-Lite practice questions

Practise 300-410 questions linked to VRF-Lite.

Route Maps and Route Filtering practice questions

Practise 300-410 questions linked to Route Maps and Route Filtering.

Administrative Distance practice questions

Practise 300-410 questions linked to Administrative Distance.

Route Summarization practice questions

Practise 300-410 questions linked to Route Summarization.

Bidirectional Forwarding Detection (BFD) practice questions

Practise 300-410 questions linked to Bidirectional Forwarding Detection (BFD).

VPN Technologies practice questions

Practise 300-410 questions linked to VPN Technologies.

Practice this exam

Start a free 300-410 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

300-410 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this 300-410 question test?

IPv6 Traffic Filtering and uRPF — This question tests IPv6 Traffic Filtering and uRPF — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: The ACL is applied outbound, but OSPFv3 packets are generated locally and are not subject to outbound ACL filtering. — Option A is correct because OSPFv3 packets are generated by the router's own control plane (the OSPF process) and are not subject to outbound ACL filtering on the interface. Outbound ACLs only filter packets that are being forwarded through the interface, not packets originated by the router itself. Since the ACL is applied outbound, the deny entry for protocol 89 never applies to locally generated OSPFv3 hello packets, so they are sent out, but the inbound side of the neighbor might still be blocked or the adjacency fails due to other reasons—but the core issue here is that outbound ACLs do not filter locally originated traffic.

What should I do if I get this 300-410 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.