mediumMultiple Choice
300-410 Practice Question: Runs the following command to troubleshoot DHCPv6…
A network engineer runs the following command to troubleshoot DHCPv6 guard:
R1# debug ipv6 dhcp guard *Mar 1 00:03:45.678: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 SOLICIT from fe80::3, client DUID 00010001abcd1234 *Mar 1 00:03:45.678: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 SOLICIT from fe80::3 is allowed by policy DHCP-POLICY *Mar 1 00:03:46.901: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 ADVERTISE from fe80::4, server DUID 0001000156789012 *Mar 1 00:03:46.901: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 ADVERTISE from fe80::4 is blocked by policy DHCP-POLICY
What does this output indicate?
⚠ Common exam trap
Cisco often tests the misconception that DHCPv6 guard blocks all DHCPv6 traffic, when in fact it only blocks server messages from untrusted sources, allowing client messages to pass through.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCPv6 guard is allowing client messages but blocking server messages from untrusted sources, preventing rogue DHCPv6 servers.
The debug output shows that DHCPv6 SOLICIT messages from client fe80::3 are allowed by policy DHCP-POLICY, while DHCPv6 ADVERTISE messages from server fe80::4 are blocked by the same policy. This is the expected behavior of DHCPv6 guard: it permits client messages (SOLICIT, REQUEST, etc.) to reach potential servers, but it blocks server messages (ADVERTISE, REPLY, etc.) from untrusted ports to prevent rogue DHCPv6 servers from assigning malicious configurations. Option A correctly identifies this selective filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DHCPv6 guard is allowing client messages but blocking server messages from untrusted sources, preventing rogue DHCPv6 servers.
Why this is correct
DHCPv6 guard distinguishes message roles: SOLICIT from the client is permitted, while ADVERTISE from the server is dropped because Fa0/0 is configured as untrusted for server messages. This satisfies the stem's constraint of blocking rogue DHCPv6 servers while still allowing legitimate client requests through the same interface.
- ✗
DHCPv6 guard is blocking all DHCPv6 messages, indicating a misconfiguration.
Why it's wrong here
The log shows the SOLICIT allowed and only the ADVERTISE from fe80::4 blocked, so guard is filtering server advertisements, not all traffic. It is tempting because blocked entries appear, but 'all messages' contradicts the explicit allow line; this option would fit only if every message were denied.
- ✗
DHCPv6 guard is allowing all messages but logging them for analysis.
Why it's wrong here
The output shows one message allowed and another blocked, so guard is enforcing policy selectively rather than logging everything. It is tempting because debug output is visible, but debug display is not the same as permit-all; this option would fit only if every message were permitted.
- ✗
DHCPv6 guard is not configured; the debug output is from default DHCPv6 behavior.
Why it's wrong here
The debug explicitly names policy DHCP-POLICY allowing the SOLICIT and blocking the ADVERTISE, which proves guard is enabled and enforcing. Guard is absent only when no policy is bound and all messages pass. This option would fit a scenario showing unfiltered server advertisements with no policy name in the output.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.