ACLs & IPv6 First-Hop Security Practice Questions

Answers and explanations appear when you work through the set above.

1. In what order does Cisco IOS evaluate the entries (ACEs) inside a single access list against a packet?

   • Bottom to top, stopping at the first match
   • Top to bottom, stopping at the first match
   • By ACE sequence number, always evaluating every line
   • Randomly, weighted by hit counters

2. An engineer appends `deny ipv6 any any log` to the end of an IPv6 ACL that is otherwise unchanged. Neighbor Discovery starts failing on that interface. What is the most likely cause?

   • IPv6 ACLs process bottom-up, so the new deny is evaluated first
   • The explicit deny now matches ICMPv6 Neighbor Solicitation and Neighbor Advertisement traffic that used to fall through to the implicit permits placed ahead of the implicit deny
   • IPv6 does not use ICMPv6 for address resolution
   • The `log` keyword forces all IPv6 traffic to be silently dropped

3. Which pair of implicit entries does classic Cisco IOS insert near the end of an IPv6 ACL, just before the implicit deny?

   • Permits for ICMPv6 Neighbor Solicitation (nd-ns) and Neighbor Advertisement (nd-na)
   • Permits for DHCPv6 Solicit and Advertise
   • Denies for all multicast destinations
   • Permits for OSPFv3 Hello and DBD packets

4. OSPFv2 adjacencies drop immediately after a new inbound infrastructure ACL is applied to a router interface. Which destination address should you confirm is still permitted?

   • 224.0.0.5, the AllSPFRouters multicast address
   • 255.255.255.255 only
   • FF02::1 only
   • TCP port 179

5. You need to match only routes within 192.168.0.0/16 whose mask length falls between /24 and /28 inclusive, for use in a route-map. Which mechanism fits best?

   • A standard ACL matching host bits
   • A prefix list using `ip prefix-list MATCH permit 192.168.0.0/16 ge 24 le 28`
   • A CoPP class-map
   • An SNMP view

6. Which Unicast Reverse Path Forwarding (uRPF) mode requires the best return path to a packet's source address to point out the exact interface the packet arrived on?

   • Loose mode (any)
   • Strict mode
   • VRF-aware loose mode
   • Feasible mode

7. A dual-homed customer site intentionally sends traffic out one ISP link and receives replies over the other. Strict uRPF on the WAN interfaces starts dropping legitimate return traffic. What is the appropriate fix?

   • Switch those interfaces to loose uRPF instead
   • Disable CEF on the router
   • Lower the OSPF dead interval
   • Apply RA Guard to the WAN interfaces

8. You want strict uRPF on an interface to still accept traffic when the only matching route toward the source is the default route. Which uRPF keyword makes that possible?

   • allow-default
   • summary-only
   • next-hop-self
   • no-export

9. Which access list type is intended to police traffic that terminates on the router itself, such as SSH, SNMP, and routing-protocol control packets, rather than transit traffic?

   • A standard numbered ACL applied to a loopback
   • The classification ACL referenced by a Control Plane Policing (CoPP) policy map
   • A reflexive ACL
   • A time-based ACL

10. After applying a new CoPP service policy, legitimate SSH sessions to the router start timing out under moderate load, while everything worked fine before. What should you check first?

    • Whether the class-map matching management traffic has too low a policing rate for current volume
    • Whether OSPF is using the wrong network type
    • Whether NHRP registration is failing
    • Whether the DHCP relay agent is misconfigured

11. A CoPP policy has classes for routing protocols, management, and a catch-all class-default. A packet fails to match any explicit class-map. Which class handles it?

    • It is dropped immediately, bypassing class-default
    • class-default, whose action (drop or restrict) then applies
    • It is automatically permitted with no policing
    • It is forwarded to whichever class has the highest configured rate

12. An IPv4 extended ACL was written and verified correct, but traffic that should be blocked is still passing. The ACL is applied to the interface. What is a common root cause worth checking first?

    • The ACL was applied in the wrong direction relative to the traffic flow (inbound versus outbound)
    • IPv4 ACLs cannot be applied to physical interfaces
    • The ACL needs to be converted to a prefix list to take effect
    • OSPF automatically overrides ACL entries

13. What is the fastest way to confirm whether a specific ACE is actually being hit by the traffic you expect it to match?

    • Reload the router and check the startup configuration
    • Review the per-entry match counters shown by `show access-list`
    • Check the CDP neighbor table
    • Check the BGP table for the same prefix

14. Which interface command applies IPv6 access list VLAN10-IN inbound?

    • `ip access-group VLAN10-IN in`
    • `ipv6 traffic-filter VLAN10-IN in`
    • `ipv6 access-class VLAN10-IN in`
    • `ip traffic-filter VLAN10-IN in`

15. What foundational function does IPv6 snooping perform for the IOS first-hop security feature set?

    • It negotiates IPsec security associations for IPv6 tunnels
    • It inspects IPv6 control-plane traffic such as ND and DHCPv6 exchanges to populate a trusted binding table
    • It converts SLAAC addresses into DHCPv6-leased addresses
    • It performs NAT64 translation for IPv6-only hosts

16. Why is the IPv6 first-hop security binding table significant to features like Source Guard and Destination Guard?

    • It stores the MPLS label bindings used for VPNv6 forwarding
    • It is where BGP stores learned next-hop attributes
    • It gives those enforcement features a trusted reference of which addresses, ports, and MAC addresses are legitimate, so they can distinguish real hosts from spoofed traffic
    • It replaces the need for a routing table on the switch

17. Which feature is specifically designed to block unauthorized Router Advertisement messages arriving on untrusted, host-facing switch ports?

    • DHCPv6 Guard
    • RA Guard
    • IPv6 Source Guard
    • IPv6 Prefix Guard

18. A user plugs in a laptop that is unintentionally running IPv6 router advertisement software, and it begins to be selected as the default gateway by nearby hosts. Which control most directly addresses this?

    • IPv6 Destination Guard
    • RA Guard on the access port
    • SNMPv3 privacy
    • uRPF loose mode

19. Which feature blocks DHCPv6 server and relay messages from appearing on switch ports that are not supposed to provide DHCPv6 service?

    • RA Guard
    • DHCPv6 Guard
    • IPv6 Source Guard
    • IPv6 Snooping alone, with no guard feature

20. Which first-hop security feature validates that the source address in an IPv6 packet corresponds to an address the port is actually authorized to use, based on binding table entries?

    • IPv6 Source Guard
    • Destination Guard
    • Prefix Guard
    • DHCPv6 Guard

21. Which first-hop security feature helps protect against traffic sent to unresolved or otherwise invalid IPv6 destination addresses, reducing unnecessary Neighbor Discovery load?

    • Prefix Guard
    • Destination Guard
    • Source Guard
    • RA Guard

22. Source Guard on an access switch suddenly begins dropping traffic from clients that were working normally minutes earlier, and the binding table for those ports is now empty. What should be investigated first?

    • Whether the CoPP policy on the router is rate-limiting SSH
    • Why the trusted IPv6 binding information (from snooping of ND and DHCPv6) is no longer being learned or has aged out for those ports
    • Whether the interface is misconfigured for OSPFv3
    • Whether the syslog severity level is set too high

23. Where in a campus network do first-hop security features such as RA Guard and DHCPv6 Guard deliver the most value?

    • On core routers carrying only transit BGP traffic
    • At the access edge, where end-host-originated IPv6 control traffic first enters the network
    • On WAN edge routers running DMVPN
    • On route reflectors in the BGP core

24. IPv6 clients on an access VLAN suddenly stop discovering a default gateway after a new first-hop security policy is rolled out, even though the actual gateway router hasn't changed. What should you verify is not being filtered too aggressively?

    • DHCPv6 Solicit messages
    • Router Advertisements from the legitimate gateway
    • TCP port 22 traffic
    • SNMP trap messages