hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer is troubleshooting an issue where a…
An engineer is troubleshooting an issue where a rogue IPv6 router is sending false Router Advertisements on the network, causing hosts to use a malicious default gateway. The switch is configured with IPv6 First Hop Security features. The engineer wants to prevent this attack while allowing the legitimate router to send RAs. What is the correct configuration approach?
⚠ Common exam trap
Cisco often tests the distinction between IPv6 First Hop Security features (RA Guard, DHCPv6 Guard, Source Guard, ND Inspection) and expects candidates to know that only RA Guard specifically blocks rogue Router Advertisements based on port role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure RA Guard with a policy that sets the legitimate router's port as 'device-role router' and all other ports as 'device-role host', and apply the policy globally.
RA Guard is the correct IPv6 First Hop Security feature to block rogue Router Advertisements (RAs) while allowing legitimate RAs. By configuring a policy that sets the legitimate router's port as 'device-role router' and all other ports as 'device-role host', the switch will forward RAs only from the trusted router port and drop RAs received on host ports. This directly prevents the attack described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure RA Guard with a policy that sets the legitimate router's port as 'device-role router' and all other ports as 'device-role host', and apply the policy globally.
Why this is correct
Correct because RA Guard will allow RAs only on ports configured as 'device-role router', blocking rogue RAs on host ports.
- ✗
Enable DHCPv6 Guard on all ports to block any DHCPv6 server messages, which will also block RAs.
Why it's wrong here
Incorrect because DHCPv6 Guard does not block RAs; it only blocks DHCPv6 server messages.
- ✗
Use IPv6 Source Guard to filter traffic from the rogue router based on its IPv6 address.
Why it's wrong here
Incorrect because IPv6 Source Guard filters data traffic, not control plane messages like RAs; RA Guard is the appropriate feature.
- ✗
Configure a static IPv6 neighbor entry for the legitimate router on the switch to override rogue RAs.
Why it's wrong here
Incorrect because static neighbor entries do not prevent the switch from processing rogue RAs; RA Guard is needed to drop them.
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.