mediumMultiple SelectObjective-mapped
300-410 Practice Question: Which TWO statements about IPv6 Neighbor…
Which TWO statements about IPv6 Neighbor Discovery (ND) Inspection are true? (Choose TWO.)
⚠ Common exam trap
Cisco often tests the distinction between IPv6 First Hop Security features, and the trap here is confusing ND Inspection (which validates ND messages) with DHCPv6 Guard (which blocks rogue DHCPv6 servers) or RA Guard (which uses prefix lists).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It validates Neighbor Solicitation and Neighbor Advertisement messages against the IPv6 snooping binding table.
IPv6 ND Inspection validates Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages against the IPv6 snooping binding table. This table is built by gleaning information from DHCPv6 messages or by using the IPv6 Neighbor Discovery protocol itself, ensuring that only legitimate ND messages from trusted sources are forwarded, preventing attacks like Neighbor Cache exhaustion or address spoofing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It validates Neighbor Solicitation and Neighbor Advertisement messages against the IPv6 snooping binding table.
Why this is correct
ND Inspection checks NS and NA messages against the binding table to prevent spoofing attacks.
- ✓
It can be configured to rate-limit ND packets on a per-interface basis.
Why this is correct
Rate-limiting is a key feature of ND Inspection to prevent DoS attacks using excessive ND messages.
- ✗
It prevents rogue DHCPv6 servers from assigning malicious addresses.
Why it's wrong here
This is the function of DHCPv6 Guard, not ND Inspection; ND Inspection focuses on ND messages, not DHCP.
- ✗
It uses a prefix list to determine which source addresses are allowed.
Why it's wrong here
ND Inspection uses the binding table, not a prefix list; prefix lists are used in other features like RA Guard.
- ✗
It is enabled globally and cannot be applied on a per-interface basis.
Why it's wrong here
ND Inspection is enabled per-interface using the 'ipv6 nd inspection' command, not just globally.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.