300-410 Infrastructure Services Practice Question
A network engineer is configuring a Cisco IOS router for IPv6 First Hop Security. The requirement is to prevent rogue DHCPv6 servers from assigning addresses to clients on a VLAN. The engineer has already enabled IPv6 snooping on the VLAN. Which additional feature should be configured to meet this requirement?
⚠ Common exam trap
Watch out — candidates often confuse DHCPv6 Guard with other IPv6 First Hop Security features like Source Guard or ND Inspection, which address different attack vectors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IPv6 DHCPv6 Guard
DHCPv6 Guard is specifically designed to block DHCPv6 server messages on untrusted ports, ensuring that only authorized DHCPv6 servers can assign addresses. With IPv6 snooping already enabled, configuring DHCPv6 Guard on the VLAN provides the necessary protection against rogue servers. Other First Hop Security features address different threats and do not fulfill this requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IPv6 ND Inspection
Why it's wrong here
IPv6 ND Inspection validates Neighbor Discovery messages to prevent spoofing of link-layer addresses and other ND attacks. It is not designed to filter DHCPv6 server messages. While it is part of First Hop Security, it does not directly prevent rogue DHCPv6 servers from assigning addresses, so it would not meet the requirement.
- ✓
IPv6 DHCPv6 Guard
Why this is correct
DHCPv6 Guard filters DHCPv6 server messages on untrusted ports, allowing only authorized servers to respond to client requests. Enabling it on the VLAN prevents rogue DHCPv6 servers from assigning addresses. Since IPv6 snooping is already enabled, adding DHCPv6 Guard provides the necessary protection against rogue servers, fulfilling the requirement.
- ✗
IPv6 Destination Guard
Why it's wrong here
IPv6 Destination Guard is used to block traffic to unused or unreachable destinations, mitigating reconnaissance and DoS attacks. It does not control DHCPv6 server responses. Enabling it would not prevent rogue DHCPv6 servers from assigning addresses, as it focuses on destination address validation rather than server authorization.
- ✗
IPv6 Source Guard
Why it's wrong here
IPv6 Source Guard uses the IPv6 snooping binding table to filter traffic based on source IPv6 addresses. It prevents address spoofing but does not block rogue DHCPv6 servers. While it is a valuable security feature, it does not address the specific threat of unauthorized DHCPv6 servers assigning addresses.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.