hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer is troubleshooting an IPv6…
An engineer is troubleshooting an IPv6 connectivity issue where hosts on VLAN 10 cannot reach the internet. The switch is configured with IPv6 First Hop Security features including RA Guard and DHCPv6 Guard. The legitimate router is connected to port Gi1/0/1. The engineer notices that the router is sending RAs, but hosts are not receiving them. The switch shows that RA Guard is dropping packets on port Gi1/0/1. What is the most likely misconfiguration?
⚠ Common exam trap
Cisco often tests the specific behavior of RA Guard's 'device-role' setting, where candidates mistakenly think RA Guard only blocks RAs from unauthorized routers, but the trap is that setting 'device-role host' on a port will drop all RAs, including those from the legitimate router, because the switch treats that port as a host port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RA Guard policy is configured with 'device-role host' on port Gi1/0/1, which causes the switch to drop all RAs received on that port.
RA Guard drops Router Advertisements (RAs) on ports where the policy's 'device-role' is set to 'host'. On port Gi1/0/1, the legitimate router is connected, but if the RA Guard policy incorrectly assigns 'device-role host' to that port, the switch will treat the router as a host and drop all incoming RAs, preventing hosts on VLAN 10 from receiving them. This matches the symptom where the router sends RAs but hosts do not receive them, and the switch reports RA Guard dropping packets on that port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The RA Guard policy is configured with 'device-role host' on port Gi1/0/1, which causes the switch to drop all RAs received on that port.
Why this is correct
Correct because 'device-role host' tells the switch that only hosts are allowed on that port; RAs from a router will be dropped.
- ✗
DHCPv6 Guard is configured on port Gi1/0/1, blocking the router's DHCPv6 server messages.
Why it's wrong here
Incorrect because DHCPv6 Guard blocks DHCPv6 server messages, not RAs; the symptom is about RAs being dropped.
- ✗
IPv6 Source Guard is enabled on the VLAN, and the router's IPv6 address is not in the binding table.
Why it's wrong here
Incorrect because IPv6 Source Guard filters traffic based on source address, not RAs; RAs are multicast and typically not filtered by Source Guard.
- ✗
The switch has IPv6 unicast-routing enabled, and it is sending its own RAs, causing a conflict.
Why it's wrong here
Incorrect because the issue is that the router's RAs are being dropped, not that there are conflicting RAs.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.