mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer is troubleshooting a network where…
An engineer is troubleshooting a network where IPv6 hosts on VLAN 20 are unable to communicate with each other. The switch is configured with IPv6 First Hop Security features including Private VLAN (PVLAN) and IPv6 Source Guard. The hosts are in the same VLAN but cannot ping each other. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the misconception that IPv6 Source Guard or RA Guard blocks all inter-host traffic, when in fact Private VLAN is the feature specifically designed to isolate hosts within the same VLAN at Layer 2.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.
Private VLAN (PVLAN) on VLAN 20 isolates ports within the same VLAN, preventing direct communication between hosts on isolated ports. Even though the hosts share the same VLAN, PVLAN restricts traffic so that isolated ports can only communicate with a promiscuous port (e.g., a router uplink), not with each other. This directly explains why IPv6 hosts on VLAN 20 cannot ping each other.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.
Why this is correct
Correct because PVLAN isolates traffic between hosts on isolated ports within the same VLAN.
- ✗
IPv6 Source Guard is blocking inter-host traffic because the hosts' bindings are not in the binding table.
Why it's wrong here
Incorrect because IPv6 Source Guard filters traffic based on source address to prevent spoofing, but it does not block all inter-host traffic; if both hosts have valid bindings, traffic should be allowed.
- ✗
RA Guard is blocking Neighbor Advertisements between hosts.
Why it's wrong here
Incorrect because RA Guard only filters Router Advertisements and Redirects, not Neighbor Advertisements between hosts.
- ✗
DHCPv6 Guard is blocking DHCPv6 messages between hosts.
Why it's wrong here
Incorrect because DHCPv6 Guard filters DHCPv6 server messages, not client-to-client traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.