mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Is troubleshooting an IPv6 neighbor discovery…
A network engineer is troubleshooting an IPv6 neighbor discovery issue on a switch running IOS-XE. Hosts on VLAN 100 are intermittently losing connectivity to the default gateway. The switch is configured with IPv6 First Hop Security features including RA Guard and DHCPv6 Guard. The engineer notices that the switch is dropping valid Router Advertisements from the legitimate router. What is the most likely cause of this issue?
⚠ Common exam trap
Cisco often tests the nuance that RA Guard with 'device-role router' does not automatically trust all routers; it requires explicit MAC address matching, and candidates may mistakenly think that setting the device role to 'router' alone is sufficient to permit RAs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RA Guard policy is configured with 'device-role router' on the port connected to the legitimate router, but the router's MAC address is not in the allowed list.
The RA Guard policy with 'device-role router' on the port connected to the legitimate router expects the router's MAC address to be in an allowed list. If the MAC address is not explicitly permitted, the switch drops all Router Advertisements from that port, including valid ones. This causes hosts on VLAN 100 to lose connectivity to the default gateway because they never receive the necessary RA to learn the gateway's IPv6 address and on-link prefix.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The RA Guard policy is configured with 'device-role router' on the port connected to the legitimate router, but the router's MAC address is not in the allowed list.
Why this is correct
Correct because RA Guard requires explicit authorization of routers; if the legitimate router's MAC is not allowed, its RAs are dropped.
- ✗
DHCPv6 Guard is blocking DHCPv6 Advertise messages from the router, preventing hosts from obtaining IPv6 addresses.
Why it's wrong here
Incorrect because DHCPv6 Guard blocks DHCPv6 server messages, not RAs; the symptom is about RA loss, not DHCP.
- ✗
IPv6 Source Guard is dropping packets from the router because the router's IPv6 address is not in the binding table.
Why it's wrong here
Incorrect because IPv6 Source Guard filters traffic based on source IPv6 address and MAC, but RAs are multicast and typically not filtered by Source Guard.
- ✗
The switch has IPv6 unicast-routing enabled, causing it to send its own RAs and override the legitimate router.
Why it's wrong here
Incorrect because the switch would send RAs only if it is configured as a router; the issue is about dropping RAs, not sending conflicting ones.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.