mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Is troubleshooting an issue where IPv6 hosts are…
A network engineer is troubleshooting an issue where IPv6 hosts are receiving multiple Router Advertisements from different routers, causing routing instability. The switch is configured with IPv6 First Hop Security features. The engineer wants to ensure that only the primary router's RAs are accepted by hosts. What is the most effective solution?
⚠ Common exam trap
Cisco often tests the distinction between IPv6 First Hop Security features, where candidates confuse RA Guard (which filters RAs) with DHCPv6 Guard (which filters DHCPv6 messages) or IPv6 Source Guard (which prevents address spoofing), leading them to select an option that addresses a different type of attack or instability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure RA Guard with a policy that includes the primary router's MAC address in the allowed list and apply it to all ports.
RA Guard with a policy that includes the primary router's MAC address in the allowed list is the most effective solution because it filters Router Advertisements (RAs) at Layer 2, permitting only RAs from the trusted primary router. This directly addresses the issue of multiple RAs causing routing instability by blocking RAs from any other source, such as the secondary router, without affecting other IPv6 traffic. RA Guard is an IPv6 First Hop Security feature designed specifically to prevent rogue or unwanted RAs from being processed by hosts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure RA Guard with a policy that includes the primary router's MAC address in the allowed list and apply it to all ports.
Why this is correct
Correct because RA Guard will drop RAs from any router not in the allowed list, preventing multiple routers from sending RAs.
- ✗
Enable DHCPv6 Guard to block DHCPv6 messages from the secondary router.
Why it's wrong here
Incorrect because DHCPv6 Guard does not affect RAs; it only blocks DHCPv6 server messages.
- ✗
Use IPv6 Source Guard to filter traffic from the secondary router.
Why it's wrong here
Incorrect because IPv6 Source Guard filters data traffic, not RAs.
- ✗
Configure the switch to act as a router and send its own RAs with a higher priority to override the secondary router.
Why it's wrong here
Incorrect because this would add another router sending RAs, potentially worsening the instability; RA Guard is the correct tool.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.