mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Runs the following command to troubleshoot an…
A network engineer runs the following command to troubleshoot an IPv6 First Hop Security issue:
R1# debug ipv6 nd raguard *Mar 1 00:01:23.456: IPv6-ND-RA-Guard: R1, Fa0/0, RA received on port Fa0/0, src fe80::1, dst ff02::1 *Mar 1 00:01:23.456: IPv6-ND-RA-Guard: R1, Fa0/0, RA from fe80::1 is allowed by policy TRUSTED *Mar 1 00:01:24.789: IPv6-ND-RA-Guard: R1, Fa0/0, RA received on port Fa0/0, src fe80::2, dst ff02::1 *Mar 1 00:01:24.789: IPv6-ND-RA-Guard: R1, Fa0/0, RA from fe80::2 is blocked by policy UNTRUSTED
What does this output indicate?
⚠ Common exam trap
Cisco often tests the misconception that RA Guard blocks all RAs or only logs them, when in fact it uses policy-based filtering that can selectively permit or deny based on the source link-local address and the configured device role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RA Guard is configured with a policy that trusts fe80::1 and blocks fe80::2, preventing rogue RA attacks.
The debug output shows that RA Guard is actively filtering Router Advertisement (RA) messages on interface Fa0/0. The first RA from fe80::1 is explicitly allowed by a policy named TRUSTED, while the second RA from fe80::2 is blocked by a policy named UNTRUSTED. This confirms that RA Guard is correctly configured to permit only authorized routers (fe80::1) and block potential rogue RA sources (fe80::2), preventing RA-based attacks in an IPv6 First Hop Security deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
RA Guard is configured with a policy that trusts fe80::1 and blocks fe80::2, preventing rogue RA attacks.
Why this is correct
The debug confirms that fe80::1 is allowed by policy TRUSTED and fe80::2 is blocked by policy UNTRUSTED, which is the expected behavior for RA Guard.
- ✗
RA Guard is blocking all RAs regardless of source, indicating a misconfiguration.
Why it's wrong here
The output shows one RA allowed and one blocked, so not all RAs are blocked.
- ✗
RA Guard is allowing all RAs but logging them for analysis.
Why it's wrong here
The output explicitly shows a blocked RA, so not all are allowed.
- ✗
RA Guard is not configured; the debug output is from default IPv6 ND behavior.
Why it's wrong here
The debug output specifically references RA Guard policies, indicating it is configured.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.