hardMultiple ChoiceObjective-mapped
300-410 Practice Question: A network administrator configures 'ipv6 nd…
A network administrator configures 'ipv6 nd raguard' on a switch port connected to a router. The router is sending Router Advertisements with a non-zero Router Lifetime. The switch logs indicate that RAs are being dropped, and the port goes into err-disable state. The engineer checks the RA Guard policy and sees that the default policy is applied. What is the most likely reason for the drops?
⚠ Common exam trap
Cisco often tests the specific hop-limit validation in the default RA Guard policy, where candidates mistakenly think the issue is with port mode or MAC addressing rather than the hop-limit field.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RA has a hop-limit less than 255, which RA Guard treats as invalid and drops.
The default RA Guard policy on Cisco switches blocks Router Advertisements (RAs) that do not have a hop limit of 255. This is because legitimate routers always send RAs with a hop limit of 255, as specified in RFC 4861. When the router sends an RA with a hop limit less than 255, RA Guard treats it as invalid and drops it, which can also trigger err-disable state on the port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The RA has a hop-limit less than 255, which RA Guard treats as invalid and drops.
Why this is correct
RA Guard expects hop-limit of 255 for locally generated RAs.
- ✗
The RA Guard policy is configured to block all RAs regardless of source.
Why it's wrong here
Default policy blocks RAs from untrusted ports, but not all.
- ✗
The router is using a multicast MAC address that is not allowed by RA Guard.
Why it's wrong here
RA Guard does not filter based on MAC.
- ✗
The switch port is in access mode, and RA Guard only works on trunk ports.
Why it's wrong here
RA Guard works on any port.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.