hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures IPv6 Source Guard on a…
An engineer configures IPv6 Source Guard on a switch port with 'ipv6 verify source' and also enables 'ipv6 snooping' globally. A legitimate host on that port is unable to send traffic, and the switch logs show that packets are being dropped due to source address validation failure. The host has a static IPv6 address and the engineer has configured a static binding using 'ipv6 neighbor binding' command. What is the most likely oversight?
⚠ Common exam trap
Cisco often tests the misconception that a static binding alone is sufficient for IPv6 Source Guard, when in fact the binding must be resolved via ND (NA message) to become active and allow traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The static binding must be associated with a valid ND entry; without an NA from the host, the binding remains incomplete.
IPv6 Source Guard relies on the Neighbor Discovery (ND) cache to validate source addresses. Even with a static binding configured via 'ipv6 neighbor binding', the binding remains in an 'incomplete' state until the switch receives a valid Neighbor Advertisement (NA) from the host. Without a complete ND entry, the switch drops packets from the host as the source address cannot be verified against a valid binding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The static binding must be associated with a valid ND entry; without an NA from the host, the binding remains incomplete.
Why this is correct
Source Guard requires the binding to be in REACHABLE state, which requires ND activity.
- ✗
The 'ipv6 verify source' command must include the 'allow-default' option to work with static addresses.
Why it's wrong here
allow-default is for uRPF, not Source Guard.
- ✗
The switch port must be configured as 'trusted' for IPv6 snooping.
Why it's wrong here
Trust is for DHCP Guard, not Source Guard.
- ✗
The host must use DHCPv6 to obtain an address for Source Guard to work.
Why it's wrong here
Source Guard works with static addresses if bindings are present.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.