IPv6 First Hop Security practice questions

A network engineer is troubleshooting an IPv6 neighbor discovery issue on a switch running IOS-XE. Hosts on VLAN 100 are intermittently losing connectivity to the default gateway. The switch is configured with IPv6 First Hop Security features including RA Guard and DHCPv6 Guard. The engineer notices that the switch is dropping valid Router Advertisements from the legitimate router. What is the most likely cause of this issue?

Trap 1: DHCPv6 Guard is blocking DHCPv6 Advertise messages from the router,…

Incorrect because DHCPv6 Guard blocks DHCPv6 server messages, not RAs; the symptom is about RA loss, not DHCP.

Trap 2: IPv6 Source Guard is dropping packets from the router because the…

Incorrect because IPv6 Source Guard filters traffic based on source IPv6 address and MAC, but RAs are multicast and typically not filtered by Source Guard.

Trap 3: The switch has IPv6 unicast-routing enabled, causing it to send its…

Incorrect because the switch would send RAs only if it is configured as a router; the issue is about dropping RAs, not sending conflicting ones.

A
The RA Guard policy is configured with 'device-role router' on the port connected to the legitimate router, but the router's MAC address is not in the allowed list.
Correct because RA Guard requires explicit authorization of routers; if the legitimate router's MAC is not allowed, its RAs are dropped.
B
DHCPv6 Guard is blocking DHCPv6 Advertise messages from the router, preventing hosts from obtaining IPv6 addresses.
Why wrong: Incorrect because DHCPv6 Guard blocks DHCPv6 server messages, not RAs; the symptom is about RA loss, not DHCP.
C
IPv6 Source Guard is dropping packets from the router because the router's IPv6 address is not in the binding table.
Why wrong: Incorrect because IPv6 Source Guard filters traffic based on source IPv6 address and MAC, but RAs are multicast and typically not filtered by Source Guard.
D
The switch has IPv6 unicast-routing enabled, causing it to send its own RAs and override the legitimate router.
Why wrong: Incorrect because the switch would send RAs only if it is configured as a router; the issue is about dropping RAs, not sending conflicting ones.

Question 2hardmultiple choice

An engineer is troubleshooting a network where IPv6 hosts cannot obtain IP addresses via DHCPv6. The switch is configured with DHCPv6 Guard to prevent rogue DHCP servers. The legitimate DHCPv6 server is connected to port GigabitEthernet1/0/1. The engineer sees that DHCPv6 Solicit messages from hosts reach the server, but the server's Advertise and Reply messages are not reaching the hosts. What is the most likely root cause?

Trap 1: RA Guard is blocking the DHCPv6 server's Router Advertisements,…

Incorrect because the symptom states Solicit messages reach the server, so RA Guard is not the issue.

Trap 2: IPv6 Source Guard is filtering the server's responses because the…

Incorrect because Source Guard filters based on source address of traffic from hosts, not from servers; also, DHCPv6 server messages are typically not filtered by Source Guard.

Trap 3: The switch has DHCP snooping enabled for IPv4, which is interfering…

Incorrect because IPv4 DHCP snooping does not affect IPv6 DHCPv6; they are separate processes.

A
The DHCPv6 Guard policy is applied globally, and the port connected to the DHCP server is not configured as a trusted port for DHCPv6 server messages.
Correct because DHCPv6 Guard by default blocks server messages on untrusted ports; the server port must be explicitly trusted.
B
RA Guard is blocking the DHCPv6 server's Router Advertisements, causing hosts to not send Solicit messages.
Why wrong: Incorrect because the symptom states Solicit messages reach the server, so RA Guard is not the issue.
C
IPv6 Source Guard is filtering the server's responses because the server's IPv6 address is not in the binding table.
Why wrong: Incorrect because Source Guard filters based on source address of traffic from hosts, not from servers; also, DHCPv6 server messages are typically not filtered by Source Guard.
D
The switch has DHCP snooping enabled for IPv4, which is interfering with IPv6 DHCPv6 operation.
Why wrong: Incorrect because IPv4 DHCP snooping does not affect IPv6 DHCPv6; they are separate processes.

Question 3mediummultiple choice

A network engineer is troubleshooting an issue where IPv6 traffic is being forwarded incorrectly on a switch. The switch is configured with IPv6 Source Guard on access ports. A legitimate host on port Fa0/1 with IPv6 address 2001:db8:1::10 is unable to send traffic to the default gateway. The engineer checks the IPv6 binding table and sees that the host's entry is missing. What is the most likely cause?

Trap 1: The host's MAC address is not in the MAC address table for VLAN 1.

Incorrect because the MAC address table is for Layer 2 forwarding; IPv6 Source Guard operates at Layer 3 and uses the binding table.

Trap 2: The switch is running IPv6 First Hop Security in monitor mode,…

Incorrect because in monitor mode, traffic is not dropped; the symptom is that traffic is not being forwarded.

Trap 3: The default gateway router is not sending Router Advertisements, so…

Incorrect because the issue is about the host's traffic being dropped by the switch, not about the host's routing table.

A
The host is using a static IPv6 address, and ND snooping is not enabled on the VLAN, so the binding was never learned.
Correct because IPv6 Source Guard relies on ND snooping to learn static addresses; without it, the host's traffic is dropped.
B
The host's MAC address is not in the MAC address table for VLAN 1.
Why wrong: Incorrect because the MAC address table is for Layer 2 forwarding; IPv6 Source Guard operates at Layer 3 and uses the binding table.
C
The switch is running IPv6 First Hop Security in monitor mode, which logs violations but does not drop traffic.
Why wrong: Incorrect because in monitor mode, traffic is not dropped; the symptom is that traffic is not being forwarded.
D
The default gateway router is not sending Router Advertisements, so the host cannot form a default route.
Why wrong: Incorrect because the issue is about the host's traffic being dropped by the switch, not about the host's routing table.

Question 4hardmultiple choice

An engineer is troubleshooting an IPv6 connectivity issue where hosts on VLAN 10 cannot reach the internet. The switch is configured with IPv6 First Hop Security features including RA Guard and DHCPv6 Guard. The legitimate router is connected to port Gi1/0/1. The engineer notices that the router is sending RAs, but hosts are not receiving them. The switch shows that RA Guard is dropping packets on port Gi1/0/1. What is the most likely misconfiguration?

Trap 1: DHCPv6 Guard is configured on port Gi1/0/1, blocking the router's…

Incorrect because DHCPv6 Guard blocks DHCPv6 server messages, not RAs; the symptom is about RAs being dropped.

Trap 2: IPv6 Source Guard is enabled on the VLAN, and the router's IPv6…

Incorrect because IPv6 Source Guard filters traffic based on source address, not RAs; RAs are multicast and typically not filtered by Source Guard.

Trap 3: The switch has IPv6 unicast-routing enabled, and it is sending its…

Incorrect because the issue is that the router's RAs are being dropped, not that there are conflicting RAs.

A
The RA Guard policy is configured with 'device-role host' on port Gi1/0/1, which causes the switch to drop all RAs received on that port.
Correct because 'device-role host' tells the switch that only hosts are allowed on that port; RAs from a router will be dropped.
B
DHCPv6 Guard is configured on port Gi1/0/1, blocking the router's DHCPv6 server messages.
Why wrong: Incorrect because DHCPv6 Guard blocks DHCPv6 server messages, not RAs; the symptom is about RAs being dropped.
C
IPv6 Source Guard is enabled on the VLAN, and the router's IPv6 address is not in the binding table.
Why wrong: Incorrect because IPv6 Source Guard filters traffic based on source address, not RAs; RAs are multicast and typically not filtered by Source Guard.
D
The switch has IPv6 unicast-routing enabled, and it is sending its own RAs, causing a conflict.
Why wrong: Incorrect because the issue is that the router's RAs are being dropped, not that there are conflicting RAs.

Question 5hardmultiple choice

A network engineer is troubleshooting an issue where IPv6 hosts are unable to perform Duplicate Address Detection (DAD) successfully. The switch is configured with IPv6 First Hop Security features including ND Inspection and ND Suppress. The engineer notices that Neighbor Solicitation messages for DAD are being dropped by the switch. What is the most likely cause?

Trap 1: RA Guard is configured to drop all multicast traffic, including…

Incorrect because RA Guard only filters Router Advertisements and Redirect messages, not Neighbor Solicitations.

Trap 2: DHCPv6 Guard is blocking the DAD messages because they are…

Incorrect because DHCPv6 Guard only filters DHCPv6 messages, not Neighbor Discovery messages.

Trap 3: IPv6 Source Guard is dropping the DAD messages because the source…

Incorrect because IPv6 Source Guard filters data traffic based on source address, but DAD messages are control plane and typically not filtered by Source Guard; ND Inspection is the correct feature.

A
ND Inspection is configured to drop Neighbor Solicitations with an unspecified source address (::) because it has no binding for that address.
Correct because ND Inspection typically requires a valid binding for the source address; DAD uses :: as source, which is not in the binding table, causing drops.
B
RA Guard is configured to drop all multicast traffic, including Neighbor Solicitations.
Why wrong: Incorrect because RA Guard only filters Router Advertisements and Redirect messages, not Neighbor Solicitations.
C
DHCPv6 Guard is blocking the DAD messages because they are considered DHCPv6 traffic.
Why wrong: Incorrect because DHCPv6 Guard only filters DHCPv6 messages, not Neighbor Discovery messages.
D
IPv6 Source Guard is dropping the DAD messages because the source address :: is not in the binding table.
Why wrong: Incorrect because IPv6 Source Guard filters data traffic based on source address, but DAD messages are control plane and typically not filtered by Source Guard; ND Inspection is the correct feature.

Question 6mediummultiple choice

An engineer is troubleshooting a network where IPv6 hosts on VLAN 20 are unable to communicate with each other. The switch is configured with IPv6 First Hop Security features including Private VLAN (PVLAN) and IPv6 Source Guard. The hosts are in the same VLAN but cannot ping each other. What is the most likely cause?

Trap 1: IPv6 Source Guard is blocking inter-host traffic because the hosts'…

Incorrect because IPv6 Source Guard filters traffic based on source address to prevent spoofing, but it does not block all inter-host traffic; if both hosts have valid bindings, traffic should be allowed.

Trap 2: RA Guard is blocking Neighbor Advertisements between hosts.

Incorrect because RA Guard only filters Router Advertisements and Redirects, not Neighbor Advertisements between hosts.

Trap 3: DHCPv6 Guard is blocking DHCPv6 messages between hosts.

Incorrect because DHCPv6 Guard filters DHCPv6 server messages, not client-to-client traffic.

A
The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.
Correct because PVLAN isolates traffic between hosts on isolated ports within the same VLAN.
B
IPv6 Source Guard is blocking inter-host traffic because the hosts' bindings are not in the binding table.
Why wrong: Incorrect because IPv6 Source Guard filters traffic based on source address to prevent spoofing, but it does not block all inter-host traffic; if both hosts have valid bindings, traffic should be allowed.
C
RA Guard is blocking Neighbor Advertisements between hosts.
Why wrong: Incorrect because RA Guard only filters Router Advertisements and Redirects, not Neighbor Advertisements between hosts.
D
DHCPv6 Guard is blocking DHCPv6 messages between hosts.
Why wrong: Incorrect because DHCPv6 Guard filters DHCPv6 server messages, not client-to-client traffic.

Question 7mediummultiple choice

A network engineer is troubleshooting an issue where IPv6 traffic from a host is being dropped by the switch. The switch has IPv6 Source Guard enabled. The host has a static IPv6 address 2001:db8:2::20. The engineer sees that the binding table does not contain an entry for this host. What should the engineer do to resolve the issue without disabling IPv6 Source Guard?

Trap 1: Configure the host to use DHCPv6 to obtain an address so that the…

Incorrect because while DHCPv6 snooping would create a binding, the host is using a static address; changing the host configuration may not be desirable.

Trap 2: Add a static binding entry for the host in the IPv6 binding table…

Incorrect because the 'ipv6 neighbor' command adds an entry to the switch's neighbor cache, not to the IPv6 Source Guard binding table; the binding table is populated by snooping.

Trap 3: Disable IPv6 Source Guard on the port connected to the host.

Incorrect because the question asks to resolve the issue without disabling IPv6 Source Guard.

A
Enable IPv6 ND snooping on the VLAN to allow the switch to learn the host's binding from Neighbor Discovery messages.
Correct because ND snooping creates bindings for static addresses, allowing IPv6 Source Guard to permit traffic.
B
Configure the host to use DHCPv6 to obtain an address so that the binding is learned via DHCPv6 snooping.
Why wrong: Incorrect because while DHCPv6 snooping would create a binding, the host is using a static address; changing the host configuration may not be desirable.
C
Add a static binding entry for the host in the IPv6 binding table using the 'ipv6 neighbor' command.
Why wrong: Incorrect because the 'ipv6 neighbor' command adds an entry to the switch's neighbor cache, not to the IPv6 Source Guard binding table; the binding table is populated by snooping.
D
Disable IPv6 Source Guard on the port connected to the host.
Why wrong: Incorrect because the question asks to resolve the issue without disabling IPv6 Source Guard.

Question 8hardmultiple choice

An engineer is troubleshooting an issue where a rogue IPv6 router is sending false Router Advertisements on the network, causing hosts to use a malicious default gateway. The switch is configured with IPv6 First Hop Security features. The engineer wants to prevent this attack while allowing the legitimate router to send RAs. What is the correct configuration approach?

Trap 1: Enable DHCPv6 Guard on all ports to block any DHCPv6 server…

Incorrect because DHCPv6 Guard does not block RAs; it only blocks DHCPv6 server messages.

Trap 2: Use IPv6 Source Guard to filter traffic from the rogue router based…

Incorrect because IPv6 Source Guard filters data traffic, not control plane messages like RAs; RA Guard is the appropriate feature.

Trap 3: Configure a static IPv6 neighbor entry for the legitimate router on…

Incorrect because static neighbor entries do not prevent the switch from processing rogue RAs; RA Guard is needed to drop them.

A
Configure RA Guard with a policy that sets the legitimate router's port as 'device-role router' and all other ports as 'device-role host', and apply the policy globally.
Correct because RA Guard will allow RAs only on ports configured as 'device-role router', blocking rogue RAs on host ports.
B
Enable DHCPv6 Guard on all ports to block any DHCPv6 server messages, which will also block RAs.
Why wrong: Incorrect because DHCPv6 Guard does not block RAs; it only blocks DHCPv6 server messages.
C
Use IPv6 Source Guard to filter traffic from the rogue router based on its IPv6 address.
Why wrong: Incorrect because IPv6 Source Guard filters data traffic, not control plane messages like RAs; RA Guard is the appropriate feature.
D
Configure a static IPv6 neighbor entry for the legitimate router on the switch to override rogue RAs.
Why wrong: Incorrect because static neighbor entries do not prevent the switch from processing rogue RAs; RA Guard is needed to drop them.

Question 9mediummultiple choice

A network engineer is troubleshooting an issue where IPv6 hosts are receiving multiple Router Advertisements from different routers, causing routing instability. The switch is configured with IPv6 First Hop Security features. The engineer wants to ensure that only the primary router's RAs are accepted by hosts. What is the most effective solution?

Trap 1: Enable DHCPv6 Guard to block DHCPv6 messages from the secondary…

Incorrect because DHCPv6 Guard does not affect RAs; it only blocks DHCPv6 server messages.

Trap 2: Use IPv6 Source Guard to filter traffic from the secondary router.

Incorrect because IPv6 Source Guard filters data traffic, not RAs.

Trap 3: Configure the switch to act as a router and send its own RAs with a…

Incorrect because this would add another router sending RAs, potentially worsening the instability; RA Guard is the correct tool.

A
Configure RA Guard with a policy that includes the primary router's MAC address in the allowed list and apply it to all ports.
Correct because RA Guard will drop RAs from any router not in the allowed list, preventing multiple routers from sending RAs.
B
Enable DHCPv6 Guard to block DHCPv6 messages from the secondary router.
Why wrong: Incorrect because DHCPv6 Guard does not affect RAs; it only blocks DHCPv6 server messages.
C
Use IPv6 Source Guard to filter traffic from the secondary router.
Why wrong: Incorrect because IPv6 Source Guard filters data traffic, not RAs.
D
Configure the switch to act as a router and send its own RAs with a higher priority to override the secondary router.
Why wrong: Incorrect because this would add another router sending RAs, potentially worsening the instability; RA Guard is the correct tool.

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 snooping policy
Interface                      Policy                      Role            State

Gi0/0/0 GUARD_POLICY device-guard ACTIVE Gi0/0/1 GUARD_POLICY device-guard ACTIVE Gi0/0/2 (default) host ACTIVE

Based on this output, which statement is correct?

Trap 1: Interface Gi0/0/2 is protected by the GUARD_POLICY policy.

Gi0/0/2 uses the default policy, not GUARD_POLICY.

Trap 2: All interfaces are equally protected by the same policy.

Gi0/0/0 and Gi0/0/1 use GUARD_POLICY, while Gi0/0/2 uses the default policy.

Trap 3: The role 'host' means Gi0/0/2 is acting as a device-guard.

The role 'host' indicates it is a host-facing interface, not a device-guard.

A
Interface Gi0/0/2 is protected by the GUARD_POLICY policy.
Why wrong: Gi0/0/2 uses the default policy, not GUARD_POLICY.
B
Interface Gi0/0/2 is not protected by the custom guard policy and may be vulnerable to spoofing attacks.
The default policy provides minimal protection; the custom GUARD_POLICY is not applied to Gi0/0/2.
C
All interfaces are equally protected by the same policy.
Why wrong: Gi0/0/0 and Gi0/0/1 use GUARD_POLICY, while Gi0/0/2 uses the default policy.
D
The role 'host' means Gi0/0/2 is acting as a device-guard.
Why wrong: The role 'host' indicates it is a host-facing interface, not a device-guard.

Question 11mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 nd raguard policy
Interface                      Policy                      Role            State

Gi0/0/0 RA_GUARD router ACTIVE Gi0/0/1 RA_GUARD host ACTIVE Gi0/0/2 (default) host ACTIVE

Based on this output, which statement is correct?

Trap 1: Interface Gi0/0/1 is allowed to send Router Advertisements.

Role 'host' blocks RAs.

Trap 2: Interface Gi0/0/2 is allowed to send Router Advertisements.

Default policy with role 'host' blocks RAs.

Trap 3: All interfaces are blocked from sending Router Advertisements.

Gi0/0/0 is permitted to send RAs.

A
Interface Gi0/0/0 is allowed to send Router Advertisements.
Role 'router' under RA guard permits sending RAs.
B
Interface Gi0/0/1 is allowed to send Router Advertisements.
Why wrong: Role 'host' blocks RAs.
C
Interface Gi0/0/2 is allowed to send Router Advertisements.
Why wrong: Default policy with role 'host' blocks RAs.
D
All interfaces are blocked from sending Router Advertisements.
Why wrong: Gi0/0/0 is permitted to send RAs.

Question 12mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp guard policy
Interface                      Policy                      Role            State

Gi0/0/0 DHCP_GUARD server ACTIVE Gi0/0/1 DHCP_GUARD client ACTIVE Gi0/0/2 (default) client ACTIVE

Based on this output, which statement is correct?

Trap 1: Interface Gi0/0/1 is trusted to send DHCPv6 replies.

Role 'client' blocks DHCP replies.

Trap 2: Interface Gi0/0/2 is trusted to send DHCPv6 replies.

Default policy with role 'client' blocks DHCP replies.

Trap 3: All interfaces are blocked from sending DHCPv6 replies.

Gi0/0/0 is permitted to send DHCP replies.

A
Interface Gi0/0/0 is trusted to send DHCPv6 replies.
Role 'server' allows sending DHCP replies.
B
Interface Gi0/0/1 is trusted to send DHCPv6 replies.
Why wrong: Role 'client' blocks DHCP replies.
C
Interface Gi0/0/2 is trusted to send DHCPv6 replies.
Why wrong: Default policy with role 'client' blocks DHCP replies.
D
All interfaces are blocked from sending DHCPv6 replies.
Why wrong: Gi0/0/0 is permitted to send DHCP replies.

Question 13mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 source-guard policy
Interface                      Policy                      Role            State

Gi0/0/0 SRC_GUARD host ACTIVE Gi0/0/1 SRC_GUARD host ACTIVE Gi0/0/2 (default) host ACTIVE

Based on this output, which statement is correct?

Trap 1: Only Gi0/0/0 and Gi0/0/1 have source guard enabled.

Gi0/0/2 also has source guard via the default policy.

Trap 2: Source guard is disabled on Gi0/0/2 because it uses the default…

Default policy still enables source guard with role 'host'.

Trap 3: Role 'host' means the interface is a router port.

Role 'host' indicates it is a host-facing port.

A
Only Gi0/0/0 and Gi0/0/1 have source guard enabled.
Why wrong: Gi0/0/2 also has source guard via the default policy.
B
Source guard is enabled on all interfaces, preventing IPv6 address spoofing.
All interfaces show active state with source guard policy.
C
Source guard is disabled on Gi0/0/2 because it uses the default policy.
Why wrong: Default policy still enables source guard with role 'host'.
D
Role 'host' means the interface is a router port.
Why wrong: Role 'host' indicates it is a host-facing port.

Question 14mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 neighbors

IPv6 Address Age Link-layer Addr State Interface 2001:DB8:1::1 0 aaaa.bbbb.cccc REACH Gi0/0/0 2001:DB8:1::2 10 aaaa.bbbb.cccd STALE Gi0/0/0 2001:DB8:1::3 - aaaa.bbbb.ccce DELAY Gi0/0/1 FE80::1 0 aaaa.bbbb.cccf REACH Gi0/0/0

Based on this output, which statement is correct?

Trap 1: All neighbors are in a stable state.

The DELAY state indicates a transition; not all are stable.

Trap 2: The neighbor 2001:DB8:1::2 is unreachable.

STALE state means the entry is valid but not recently verified.

Trap 3: The link-local address FE80::1 is not valid.

It is REACH, so it is valid.

A
All neighbors are in a stable state.
Why wrong: The DELAY state indicates a transition; not all are stable.
B
The neighbor 2001:DB8:1::3 is in DELAY state, meaning a Neighbor Solicitation will be sent soon.
DELAY state means a NS is pending after a delay timer.
C
The neighbor 2001:DB8:1::2 is unreachable.
Why wrong: STALE state means the entry is valid but not recently verified.
D
The link-local address FE80::1 is not valid.
Why wrong: It is REACH, so it is valid.

Question 15mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp binding

Client: FE80::1 DUID: 0003000100AABBCCDDEE

Username: unknown

IA NA: IA ID 0x00010001, T1 302400, T2 483840 Address: 2001:DB8:1::100/128 Preferred lifetime 604800, valid lifetime 2592000 Expires at Sep 15 2024 12:00 PM (2592000 seconds)

Based on this output, which statement is correct?

Trap 1: The client is using SLAAC instead of DHCPv6.

The binding indicates DHCPv6 was used.

Trap 2: The client's lease has expired.

The valid lifetime is 2592000 seconds, so it is still valid.

Trap 3: The client is not authorized.

The username is unknown, but the binding is still active.

A
The client has been assigned an IPv6 address via DHCPv6.
The binding shows an IA NA with an assigned address.
B
The client is using SLAAC instead of DHCPv6.
Why wrong: The binding indicates DHCPv6 was used.
C
The client's lease has expired.
Why wrong: The valid lifetime is 2592000 seconds, so it is still valid.
D
The client is not authorized.
Why wrong: The username is unknown, but the binding is still active.

Question 16mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp interface Gi0/0/0

Gi0/0/0 is in server mode Uses prefix 2001:DB8:1::/64 Rapid-Commit is disabled Preference value: 0 Information refresh option: 86400 DNS server: 2001:DB8::1 Domain name: example.com Active clients: 5 Pool: DHCP_POOL

Based on this output, which statement is correct?

Trap 1: The router is acting as a DHCPv6 client on Gi0/0/0.

The interface is in server mode, not client.

Trap 2: Rapid-Commit is enabled.

It is disabled.

Trap 3: The interface is using SLAAC for address assignment.

DHCPv6 is used, not SLAAC.

A
The router is acting as a DHCPv6 client on Gi0/0/0.
Why wrong: The interface is in server mode, not client.
B
The router is acting as a DHCPv6 server on Gi0/0/0 and has 5 active clients.
Server mode with active clients indicates DHCPv6 server functionality.
C
Rapid-Commit is enabled.
Why wrong: It is disabled.
D
The interface is using SLAAC for address assignment.
Why wrong: DHCPv6 is used, not SLAAC.

Question 17mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 traffic

IPv6 statistics: Rcvd: 1000 total, 800 unicast, 200 multicast Sent: 900 total, 700 unicast, 200 multicast Errors: 0 Dropped: 0 ND statistics: NS: 50 received, 40 sent NA: 30 received, 20 sent RS: 10 received, 5 sent RA: 2 received, 8 sent Redirect: 0 received, 0 sent

Based on this output, which statement is correct?

Trap 1: The router is not sending any Router Advertisements.

8 RAs were sent.

Trap 2: There is a high number of errors in IPv6 traffic.

Errors are 0.

Trap 3: The router is dropping many packets.

Dropped is 0.

A
The router is not sending any Router Advertisements.
Why wrong: 8 RAs were sent.
B
The router is receiving more Neighbor Solicitations than it is sending, which is expected.
NS received (50) vs sent (40) is typical as the router responds to queries.
C
There is a high number of errors in IPv6 traffic.
Why wrong: Errors are 0.
D
The router is dropping many packets.
Why wrong: Dropped is 0.

Question 18mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 snooping binding

IPv6 Address MAC Address VLAN Interface State 2001:DB8:1::100 aaaa.bbbb.cccc 10 Gi0/0/0 ACTIVE 2001:DB8:1::101 aaaa.bbbb.cccd 10 Gi0/0/0 ACTIVE 2001:DB8:1::102 aaaa.bbbb.ccce 10 Gi0/0/1 ACTIVE 2001:DB8:1::103 aaaa.bbbb.cccf 10 Gi0/0/1 ACTIVE

Based on this output, which statement is correct?

Trap 1: The binding for 2001:DB8:1::103 is invalid.

It is ACTIVE, so it is valid.

Trap 2: The table shows only IPv6 addresses from SLAAC.

The binding table can include DHCPv6 and static entries as well.

Trap 3: There are no entries for VLAN 10.

All entries are in VLAN 10.

A
All entries are in the ACTIVE state, meaning they are valid bindings.
ACTIVE state indicates the binding is valid and being used.
B
The binding for 2001:DB8:1::103 is invalid.
Why wrong: It is ACTIVE, so it is valid.
C
The table shows only IPv6 addresses from SLAAC.
Why wrong: The binding table can include DHCPv6 and static entries as well.
D
There are no entries for VLAN 10.
Why wrong: All entries are in VLAN 10.

Question 19mediummultiple choice

Interface GigabitEthernet0/1 is configured as shown:

interface GigabitEthernet0/1

ipv6 address 2001:db8:1::1/64 ipv6 nd raguard ipv6 nd prefix default no-autoconfig

What is the effect of this configuration?

Trap 1: The interface sends RAs with the autonomous flag set to allow SLAAC.

The 'no-autoconfig' keyword actually clears the autonomous flag, preventing SLAAC.

Trap 2: The interface only allows RAs from a specific authorized router.

RA guard blocks all RAs, not selectively allowing any.

Trap 3: The interface drops all Neighbor Solicitations.

RA guard only filters Router Advertisements, not Neighbor Solicitations.

A
The interface drops all incoming Router Advertisements from other routers.
The 'ipv6 nd raguard' command blocks RAs received on this interface, enforcing first-hop security.
B
The interface sends RAs with the autonomous flag set to allow SLAAC.
Why wrong: The 'no-autoconfig' keyword actually clears the autonomous flag, preventing SLAAC.
C
The interface only allows RAs from a specific authorized router.
Why wrong: RA guard blocks all RAs, not selectively allowing any.
D
The interface drops all Neighbor Solicitations.
Why wrong: RA guard only filters Router Advertisements, not Neighbor Solicitations.

Question 20mediummultiple choice

Examine the following partial IPv6 DHCP guard configuration:

ipv6 dhcp guard policy DHCP_GUARD device-role server match server access-list SERVER_ACL

interface GigabitEthernet0/2

ipv6 dhcp guard policy DHCP_GUARD

Which statement is true about this configuration?

Trap 1: The interface will block all DHCP server messages.

The policy allows server messages that match the ACL, not block all.

Trap 2: The interface will allow all DHCP client messages.

The policy focuses on server messages; client messages are not explicitly filtered.

Trap 3: The interface will drop all DHCP messages.

Only server messages not matching the ACL are dropped.

A
The interface will allow DHCP server messages only from sources matching SERVER_ACL.
The 'match server' clause restricts which servers are trusted, and the policy is applied to the interface.
B
The interface will block all DHCP server messages.
Why wrong: The policy allows server messages that match the ACL, not block all.
C
The interface will allow all DHCP client messages.
Why wrong: The policy focuses on server messages; client messages are not explicitly filtered.
D
The interface will drop all DHCP messages.
Why wrong: Only server messages not matching the ACL are dropped.