300-410 IPv6 First Hop Security Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp interface Gi0/0/0
Gi0/0/0 is in server mode
  Uses prefix 2001:DB8:1::/64
  Rapid-Commit is disabled
  Preference value: 0
  Information refresh option: 86400
  DNS server: 2001:DB8::1
  Domain name: example.com
  Active clients: 5
  Pool: DHCP_POOL

Based on this output, which statement is correct?

Accepted Answer

The router is acting as a DHCPv6 server on Gi0/0/0 and has 5 active clients.. The interface is configured as a DHCPv6 server with a prefix, DNS server, and domain name. It has 5 active clients. This means the router is providing DHCPv6 services on that interface.

Answer

The router is acting as a DHCPv6 client on Gi0/0/0.

Answer

Rapid-Commit is enabled.

Answer

The interface is using SLAAC for address assignment.

Question 2

A network engineer runs the following command on Router R1:

R1# show ipv6 traffic
IPv6 statistics:
  Rcvd: 1000 total, 800 unicast, 200 multicast
  Sent: 900 total, 700 unicast, 200 multicast
  Errors: 0
  Dropped: 0
  ND statistics:
    NS: 50 received, 40 sent
    NA: 30 received, 20 sent
    RS: 10 received, 5 sent
    RA: 2 received, 8 sent
    Redirect: 0 received, 0 sent

Based on this output, which statement is correct?

Accepted Answer

The router is receiving more Neighbor Solicitations than it is sending, which is expected.. The ND statistics show that Router Advertisements (RAs) are being sent (8 sent) and received (2 received). This is normal for a router that is advertising itself. The numbers are balanced and indicate proper ND operation.

Answer

The router is not sending any Router Advertisements.

Answer

There is a high number of errors in IPv6 traffic.

Answer

The router is dropping many packets.

Question 3

A network engineer runs the following command on Router R1:

R1# show ipv6 snooping binding
IPv6 Address                              MAC Address       VLAN Interface        State
2001:DB8:1::100                           aaaa.bbbb.cccc    10    Gi0/0/0          ACTIVE
2001:DB8:1::101                           aaaa.bbbb.cccd    10    Gi0/0/0          ACTIVE
2001:DB8:1::102                           aaaa.bbbb.ccce    10    Gi0/0/1          ACTIVE
2001:DB8:1::103                           aaaa.bbbb.cccf    10    Gi0/0/1          ACTIVE

Based on this output, which statement is correct?

Accepted Answer

All entries are in the ACTIVE state, meaning they are valid bindings.. The snooping binding table shows the IPv6 addresses and corresponding MAC addresses for devices on VLAN 10. All entries are ACTIVE, meaning they have been validated. This is used for source guard and other first-hop security features.

Answer

The binding for 2001:DB8:1::103 is invalid.

Answer

The table shows only IPv6 addresses from SLAAC.

Answer

There are no entries for VLAN 10.

Question 4

Interface GigabitEthernet0/1 is configured as shown:

interface GigabitEthernet0/1
 ipv6 address 2001:db8:1::1/64
 ipv6 nd raguard
 ipv6 nd prefix default no-autoconfig

What is the effect of this configuration?

Accepted Answer

The interface drops all incoming Router Advertisements from other routers.. The 'ipv6 nd raguard' command enables Router Advertisement guard on the interface, which filters RAs. The 'ipv6 nd prefix default no-autoconfig' suppresses the autonomous address configuration flag in RAs, preventing hosts from using SLAAC.

Answer

The interface sends RAs with the autonomous flag set to allow SLAAC.

Answer

The interface only allows RAs from a specific authorized router.

Answer

The interface drops all Neighbor Solicitations.

Question 5

Examine the following partial IPv6 DHCP guard configuration:

ipv6 dhcp guard policy DHCP_GUARD
 device-role server
 match server access-list SERVER_ACL
interface GigabitEthernet0/2
 ipv6 dhcp guard policy DHCP_GUARD

Which statement is true about this configuration?

Accepted Answer

The interface will allow DHCP server messages only from sources matching SERVER_ACL.. DHCP guard policy with device-role server allows DHCP server messages only if they match the access-list. The interface applies the policy to filter DHCP messages.

Answer

The interface will block all DHCP server messages.

Answer

The interface will allow all DHCP client messages.

Answer

The interface will drop all DHCP messages.

Question 6

A network engineer configures IPv6 Source Guard on an interface:

interface GigabitEthernet0/3
 ipv6 verify source

What is the immediate effect of this command?

Accepted Answer

The interface filters all incoming IPv6 traffic unless the source address is in the DHCP snooping binding table.. IPv6 Source Guard with no additional parameters uses the DHCPv6 snooping binding table to validate source addresses. It filters traffic based on source IPv6 and MAC addresses.

Answer

The interface allows all IPv6 traffic but logs violations.

Answer

The interface only filters Neighbor Discovery messages.

Answer

The interface requires a static binding to be configured first.

Question 7

Consider the following partial configuration:

ipv6 nd inspection policy ND_INSPECT
 device-role host
 trusted-port
interface GigabitEthernet0/4
 ipv6 nd inspection policy ND_INSPECT

What is the effect of the 'trusted-port' command in this policy?

Accepted Answer

The interface is trusted, so Neighbor Discovery messages are not inspected.. The 'trusted-port' command marks the interface as trusted for Neighbor Discovery inspection, meaning ND messages are not validated. This is often used on ports connecting to other routers or switches.

Answer

The interface only allows Neighbor Advertisements from trusted sources.

Answer

The interface drops all Neighbor Discovery messages.

Answer

The interface requires a valid binding for each ND message.

Question 8

An engineer applies the following configuration to an interface:

interface GigabitEthernet0/5
 ipv6 dhcp guard attach-policy DHCP_GUARD
 ipv6 snooping database file nvram:ipv6-snoop.db

Which statement is true?

Accepted Answer

The DHCP guard policy is applied to the interface, and the snooping database is stored in NVRAM.. The 'ipv6 snooping database file' command configures the location for the IPv6 snooping binding database, but it is not directly tied to the DHCP guard policy. The attach-policy applies the guard.

Answer

The DHCP guard policy is applied only if the snooping database is present.

Answer

The interface will not forward any DHCP messages until the database is populated.

Answer

The snooping database is used to validate DHCP server messages.

Question 9

Which configuration is missing to properly implement IPv6 First Hop Security on an access switch port that should only allow traffic from a single host with a static IPv6 address 2001:db8:1::10?

Accepted Answer

The interface needs 'ipv6 verify source' and a static binding entry 'ipv6 source binding 2001:db8:1::10 interface GigabitEthernet0/6'.. To restrict traffic to a single host, you need IPv6 Source Guard with a static binding or a PACL. The missing piece is often the static binding or the source guard configuration.

Answer

The interface needs 'ipv6 nd raguard' to block RAs.

Answer

The interface needs 'ipv6 dhcp guard' to block DHCP messages.

Answer

The interface needs 'ipv6 nd inspection' to validate ND messages.

Question 10

What is the default role of an interface in IPv6 Neighbor Discovery Inspection when no policy is explicitly applied?

Accepted Answer

Untrusted. By default, all interfaces are considered untrusted for ND inspection, meaning they are subject to validation checks unless explicitly trusted.

Answer

Trusted

Answer

Server

Answer

Host

Question 11

In IPv6 First Hop Security, what is the purpose of the 'device-role' command in a DHCP guard policy?

Accepted Answer

It specifies whether the interface is a server, client, or relay for DHCP filtering.. The 'device-role' command defines whether the interface is a DHCP server, client, or relay. This determines which DHCP messages are allowed.

Answer

It sets the trust level for ND inspection.

Answer

It defines the VLAN membership for the interface.

Answer

It enables IPv6 routing on the interface.

Question 12

Which RFC defines the IPv6 Neighbor Discovery Protocol that is the basis for many First Hop Security features?

Accepted Answer

RFC 4861. RFC 4861 defines the Neighbor Discovery Protocol for IPv6, which includes Neighbor Solicitations, Advertisements, Router Solicitations, and Advertisements.

Answer

RFC 2460

Answer

RFC 4291

Answer

RFC 4443

Question 13

Which TWO commands can be used to verify the operation of IPv6 First Hop Security features such as RA Guard and DHCPv6 Guard on a Cisco IOS-XE switch? (Choose TWO.)

Accepted Answer

show ipv6 snooping. The correct commands directly display the operational state and statistics of IPv6 FHS features. 'show ipv6 snooping' provides a summary of all snooping features, and 'show ipv6 dhcp guard' shows the DHCPv6 Guard policy and its application. The incorrect options are either for different features or do not exist.

Answer

show ipv6 nd raguard

Answer

show ipv6 dhcp binding

Answer

show ipv6 source guard

Question 14

Which TWO statements about IPv6 Neighbor Discovery (ND) Inspection are true? (Choose TWO.)

Accepted Answer

It validates Neighbor Solicitation and Neighbor Advertisement messages against the IPv6 snooping binding table.. ND Inspection is a security feature that validates ND messages against a binding table. It drops invalid messages and can rate-limit ND packets. The other statements are incorrect: ND Inspection does not protect against DHCPv6 attacks, and it does not use a prefix list by default.

Answer

It prevents rogue DHCPv6 servers from assigning malicious addresses.

Answer

It uses a prefix list to determine which source addresses are allowed.

Answer

It is enabled globally and cannot be applied on a per-interface basis.

Question 15

Which TWO configuration steps are required to enable IPv6 RA Guard on a Cisco switch interface? (Choose TWO.)

Accepted Answer

Create an RA Guard policy using the 'ipv6 nd raguard policy POLICY_NAME' command.. RA Guard requires defining a policy that specifies the device role (router or host) and then applying that policy to the interface. Simply enabling 'ipv6 nd raguard' without a policy is not sufficient. The other options are either for different features or incorrect.

Answer

Enable IPv6 routing globally with 'ipv6 unicast-routing'.

Answer

Configure 'ipv6 nd raguard' directly on the interface without a policy.

Answer

Enable DHCPv6 Guard on the same interface to complement RA Guard.