hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Is troubleshooting IPv6 neighbor discovery issues…
A network engineer is troubleshooting IPv6 neighbor discovery issues on a VLAN. Router R1 is configured with IPv6 First Hop Security features. Hosts are unable to communicate with each other, even though they have valid IPv6 addresses. Router R1 has the following relevant configuration:
interface Vlan100
ipv6 address 2001:DB8:1:100::1/64 ipv6 nd raguard ipv6 dhcp guard ipv6 source guard !
Router R2 shows: debug ipv6 nd output indicates that Neighbor Solicitations from hosts are being dropped. What is the root cause?
⚠ Common exam trap
Cisco often tests the misconception that RA Guard or DHCP Guard drops Neighbor Solicitations, but the trap here is that IPv6 Source Guard is the only FHS feature that validates the source address of all IPv6 packets, including ND messages, and it drops them if no binding exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IPv6 Source Guard is dropping Neighbor Solicitations because the source address is not in the binding table.
IPv6 Source Guard (ipv6 source guard) on the VLAN interface drops any IPv6 packet whose source address is not present in the IPv6 neighbor binding table. When hosts send Neighbor Solicitations, their source IPv6 addresses are not yet in the binding table (since the NS is the first step in address resolution), causing the packets to be dropped. This prevents hosts from completing the neighbor discovery process, even though they have valid IPv6 addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RA Guard is blocking Neighbor Solicitations because they are mistaken for RAs.
Why it's wrong here
RA Guard only filters Router Advertisements, not Neighbor Solicitations.
- ✗
DHCP Guard is dropping Neighbor Solicitations because they contain DHCP options.
Why it's wrong here
DHCP Guard filters DHCP messages, not Neighbor Solicitations.
- ✓
IPv6 Source Guard is dropping Neighbor Solicitations because the source address is not in the binding table.
Why this is correct
Source Guard validates source addresses against the binding table; if the host is not bound, the NS is dropped.
- ✗
The VLAN interface is not in a state to forward ND messages due to a spanning tree issue.
Why it's wrong here
No spanning tree issue is indicated; the debug shows drops due to security features.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.