300-410 IPv6 First Hop Security Practice Test 4 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot DHCPv6 guard:

R1# debug ipv6 dhcp guard

*Mar  1 00:03:45.678: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 SOLICIT from fe80::3, client DUID 00010001abcd1234
*Mar  1 00:03:45.678: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 SOLICIT from fe80::3 is allowed by policy DHCP-POLICY
*Mar  1 00:03:46.901: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 ADVERTISE from fe80::4, server DUID 0001000156789012
*Mar  1 00:03:46.901: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 ADVERTISE from fe80::4 is blocked by policy DHCP-POLICY

What does this output indicate?

Accepted Answer

DHCPv6 guard is allowing client messages but blocking server messages from untrusted sources, preventing rogue DHCPv6 servers.. The debug shows DHCPv6 guard filtering DHCPv6 messages. Client SOLICIT is allowed, but server ADVERTISE from fe80::4 is blocked, indicating the source is not a trusted DHCPv6 server.

Answer

DHCPv6 guard is blocking all DHCPv6 messages, indicating a misconfiguration.

Answer

DHCPv6 guard is allowing all messages but logging them for analysis.

Answer

DHCPv6 guard is not configured; the debug output is from default DHCPv6 behavior.

Question 2

A network engineer runs the following command to verify DHCPv6 guard policy:

R1# show ipv6 dhcp guard policy DHCP-POLICY

Policy: DHCP-POLICY
  Status: Active
  Device role: dhcp-client
  Trusted ports: none
  Untrusted ports: Fa0/0
  DHCPv6 guard: enabled
  DHCPv6 guard action: block
  DHCPv6 server validation: enabled
  DHCPv6 server list: 2001:db8::10

What does this output indicate?

Accepted Answer

The policy blocks DHCPv6 server messages on Fa0/0 except from server 2001:db8::10.. The show command displays the DHCPv6 guard policy. The policy blocks DHCPv6 server messages on untrusted port Fa0/0, except from the listed server 2001:db8::10.

Answer

The policy allows all DHCPv6 messages on Fa0/0 without any filtering.

Answer

The policy only applies to DHCPv6 client messages and ignores server messages.

Answer

The policy is inactive and not applied to any interface.

Question 3

A network engineer runs the following command to troubleshoot IPv6 source guard:

R1# debug ipv6 source-guard

*Mar  1 00:04:56.789: IPv6-Source-Guard: R1, Fa0/0, IPv6 packet from 2001:db8::5, src MAC 0011.2233.4455, dst 2001:db8::1
*Mar  1 00:04:56.789: IPv6-Source-Guard: R1, Fa0/0, Binding lookup: 2001:db8::5 not found in binding table
*Mar  1 00:04:56.789: IPv6-Source-Guard: R1, Fa0/0, Packet dropped: source 2001:db8::5 not allowed

What does this output indicate?

Accepted Answer

IPv6 source guard is dropping packets from sources not in the binding table, preventing spoofing.. The debug shows IPv6 source guard dropping a packet because the source address 2001:db8::5 is not in the binding table, indicating an unauthorized source.

Answer

IPv6 source guard is allowing the packet because the source MAC matches.

Answer

IPv6 source guard is not configured; the debug output is from default IPv6 forwarding.

Answer

IPv6 source guard is learning the binding from the packet and will allow future packets.

Question 4

A network engineer runs the following command to verify IPv6 binding table:

R1# show ipv6 neighbors binding

IPv6 Address                     Age  Link-layer Addr  State  Interface  VLAN  Policy
2001:db8::1                      10   0011.2233.4455  REACH  Fa0/1      10    TRUSTED
2001:db8::2                      5    00aa.bbcc.ddee  STALE  Fa0/0      10    INSPECT
2001:db8::3                      0    1111.2222.3333  INCOMP Fa0/0      10    -

What does this output indicate?

Accepted Answer

The binding table shows three entries: one reachable on trusted port, one stale on untrusted port, and one incomplete, indicating active ND learning.. The show command displays the IPv6 binding table with entries learned via ND. The table shows reachable, stale, and incomplete entries with associated policies.

Answer

The binding table is empty, indicating no ND activity.

Answer

The binding table shows all entries as reachable, indicating stable neighbor relationships.

Answer

The binding table is only for DHCPv6-learned addresses.

Question 5

A network engineer runs the following command to verify IPv6 device tracking:

R1# show ipv6 device-tracking database

Interface  MAC Address       VLAN  IPv6 Address                    State         Age  Policy
  Fa0/0      0011.2233.4455   10    2001:db8::1                     ACTIVE        10   TRUSTED
  Fa0/0      00aa.bbcc.ddee   10    2001:db8::2                     ACTIVE        5    INSPECT
  Fa0/0      1111.2222.3333   10    2001:db8::3                     VERIFY        0    -

What does this output indicate?

Accepted Answer

Device tracking shows two devices in ACTIVE state and one in VERIFY state, indicating ongoing ND verification for the third device.. The show command displays the device tracking database, showing active and verifying states for devices on interface Fa0/0 with associated policies.

Answer

All devices are in ACTIVE state, indicating stable tracking.

Answer

Device tracking is disabled, and the database is empty.

Answer

Device tracking only tracks IPv4 addresses.

Question 6

What is the default value of the Router Advertisement (RA) interval in IPv6 First Hop Security (FHS) when using the 'ipv6 nd ra-interval' command on an IOS-XE interface?

Accepted Answer

200 seconds. The default RA interval on Cisco IOS-XE is 200 seconds, as per RFC 4861, but Cisco defaults to a lower value for faster convergence. The default is actually 600 seconds for the maximum RA interval, but the 'ipv6 nd ra-interval' command defaults to 200 seconds when not specified.

Answer

100 seconds

Answer

600 seconds

Answer

300 seconds

Question 7

What is the default value of the RA lifetime (Router Lifetime) in IPv6 Router Advertisements on Cisco IOS-XE?

Accepted Answer

1800 seconds. The default Router Lifetime in RA messages on Cisco IOS-XE is 1800 seconds (30 minutes), as per RFC 4861, which recommends a default of 3 times the default RA interval (600 seconds). However, Cisco defaults to 1800 seconds.

Answer

600 seconds

Answer

3600 seconds

Answer

0 seconds

Question 8

In IPv6 First Hop Security, which feature is used to prevent duplicate address detection (DAD) attacks by snooping Neighbor Discovery (ND) messages?

Accepted Answer

ND Snooping. IPv6 First Hop Security includes ND Snooping, which inspects ND messages (NS, NA, RS, RA) to build a binding table and prevent attacks like DAD exhaustion. It is the primary mechanism for ND-based attack mitigation.

Answer

RA Guard

Answer

DHCPv6 Guard

Answer

Source Guard

Question 9

What is the default value of the 'hold-down' timer in IPv6 FHS's ND Snooping feature on Cisco IOS-XE?

Accepted Answer

10 seconds. The hold-down timer in ND Snooping is used to suppress further ND messages after a DAD attempt. The default value is 10 seconds on Cisco IOS-XE, as per the implementation guide.

Answer

5 seconds

Answer

15 seconds

Answer

20 seconds

Question 10

Which IPv6 FHS feature uses a 'device tracking' database to maintain reachability information for hosts?

Accepted Answer

Device Tracking. Device Tracking is an IPv6 FHS feature that maintains a database of IPv6 addresses and their reachability status on a per-interface basis. It is used by other FHS features like ND Snooping and Source Guard.

Answer

RA Guard

Answer

DHCPv6 Guard

Answer

PACL

Question 11

In IPv6 FHS, what is the default action for 'RA Guard' when a rogue RA is detected on a switch port?

Accepted Answer

Drop the RA and generate a syslog message. The default action for RA Guard on Cisco IOS-XE is to 'drop' the offending RA message and optionally log the event. This is configured via the 'ipv6 nd raguard' command.

Answer

Forward the RA to the CPU for inspection

Answer

Shut down the port

Answer

Send a notification to the network management system

Question 12

What is the default value of the 'limit' parameter in the 'ipv6 nd prefix' command for the number of prefixes advertised in RA messages?

Accepted Answer

16. The default limit for the number of IPv6 prefixes advertised in RA messages on Cisco IOS-XE is 16. This is a Cisco-specific default, not defined in RFC 4861.

Answer

8

Answer

32

Answer

64

Question 13

In IPv6 FHS, which protocol is used to secure Neighbor Discovery messages with cryptographic authentication?

Accepted Answer

SEND. Secure Neighbor Discovery (SEND) is defined in RFC 3971 and uses Cryptographically Generated Addresses (CGAs) to authenticate ND messages. It is an IPv6 FHS mechanism to prevent ND spoofing.

Answer

IPsec

Answer

SSL/TLS

Answer

MACsec

Question 14

What is the default value of the 'reachable time' in IPv6 Neighbor Discovery (ND) on Cisco IOS-XE?

Accepted Answer

0 milliseconds (unspecified). The default reachable time in ND is 30,000 milliseconds (30 seconds) as per RFC 4861, but Cisco IOS-XE uses a default of 0 (unspecified) in RA messages, meaning hosts use their own default (typically 30 seconds). However, the default for the 'ipv6 nd reachable-time' command is 0, indicating no override.

Answer

30,000 milliseconds

Answer

60,000 milliseconds

Answer

10,000 milliseconds

Question 15

Drag and drop the steps to configure IPv6 RA Guard on a switch into the correct order, from first to last.

Accepted Answer

Enable IPv6 snooping globally. First, globally enable IPv6 snooping. Then define an RA Guard policy with the trusted or untrusted role. Apply the policy to the desired interface. Verify the configuration with show commands. Finally, test the RA Guard operation by sending RAs from unauthorized ports.