350-401 Question 561
Single answerYou are configuring an IPv6 traffic filter on a Cisco router to block all inbound traffic to the router's interface from a specific IPv6 subnet while allowing all other traffic. Which of the following is the correct approach to configure this filter?
- A
Create an IPv6 ACL with a deny statement for the specific subnet and apply it inbound on the interface.
- B
Create an IPv6 ACL with a deny statement for the specific subnet and apply it outbound on the interface.
- C
Create an IPv6 ACL with a deny statement for the specific subnet and an implicit permit-any rule, then apply it outbound on the interface.
- D
Create an IPv6 ACL with a deny statement for the specific subnet and an implicit permit-any rule, then apply it inbound on the interface.
Show answer and explanation
Correct answer: A
Explanation
IPv6 ACLs are used to filter traffic based on specific conditions. In this scenario, since the goal is to block inbound traffic from a specific IPv6 subnet, the ACL must be applied in the inbound direction on the interface. A deny statement for the subnet will block the traffic, while the default implicit permit-any rule in IPv6 ACLs ensures all other traffic is allowed. Applying the ACL in the outbound direction would not achieve the desired effect of blocking incoming traffic from the specific subnet.
- A. Correct.
This is the correct approach. Inbound traffic filtering is required to block traffic entering the router on a specific interface. The deny statement for the specific subnet in the IPv6 ACL ensures the traffic is blocked.
- B. Incorrect.
This option is incorrect because applying the ACL outbound would only filter traffic being sent out of the interface, not traffic entering the router.
- C. Incorrect.
This option is incorrect because while the ACL contains an implicit permit-any rule, applying it outbound would not block inbound traffic from the specific subnet.
- D. Incorrect.
This option is incorrect because while the ACL has the correct deny statement and implicit permit-any rule, applying it inbound is redundant since the implicit permit-any rule allows all traffic except the denied subnet. The deny-only statement suffices.