mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Is troubleshooting an issue where IPv6 traffic…
A network engineer is troubleshooting an issue where IPv6 traffic from a host is being dropped by the switch. The switch has IPv6 Source Guard enabled. The host has a static IPv6 address 2001:db8:2::20. The engineer sees that the binding table does not contain an entry for this host. What should the engineer do to resolve the issue without disabling IPv6 Source Guard?
⚠ Common exam trap
Cisco often tests the distinction between the IPv6 neighbor cache (Layer 2 mapping) and the IPv6 binding table (used by First Hop Security features), leading candidates to mistakenly choose the 'ipv6 neighbor' command as a solution for Source Guard bindings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable IPv6 ND snooping on the VLAN to allow the switch to learn the host's binding from Neighbor Discovery messages.
IPv6 Source Guard relies on the IPv6 binding table to validate traffic. When a host uses a static IPv6 address, the switch cannot learn the binding via DHCPv6 snooping. Enabling IPv6 ND snooping on the VLAN allows the switch to inspect Neighbor Discovery (ND) messages (RFC 4861) and dynamically populate the binding table with the host's IPv6 address and MAC address, thus permitting the traffic without disabling Source Guard.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable IPv6 ND snooping on the VLAN to allow the switch to learn the host's binding from Neighbor Discovery messages.
Why this is correct
Correct because ND snooping creates bindings for static addresses, allowing IPv6 Source Guard to permit traffic.
- ✗
Configure the host to use DHCPv6 to obtain an address so that the binding is learned via DHCPv6 snooping.
Why it's wrong here
Incorrect because while DHCPv6 snooping would create a binding, the host is using a static address; changing the host configuration may not be desirable.
- ✗
Add a static binding entry for the host in the IPv6 binding table using the 'ipv6 neighbor' command.
Why it's wrong here
Incorrect because the 'ipv6 neighbor' command adds an entry to the switch's neighbor cache, not to the IPv6 Source Guard binding table; the binding table is populated by snooping.
- ✗
Disable IPv6 Source Guard on the port connected to the host.
Why it's wrong here
Incorrect because the question asks to resolve the issue without disabling IPv6 Source Guard.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.