hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Enables IPv6 First Hop Security with 'ipv6 dhcp…
A network engineer enables IPv6 First Hop Security with 'ipv6 dhcp guard' on a switch port connected to a legitimate DHCPv6 server. Clients on other ports receive DHCPv6 replies, but the server's port is being err-disabled repeatedly. The engineer checks the logs and sees DHCPv6 server advertisements being dropped. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the default untrusted behavior of DHCPv6 Guard, where candidates mistakenly assume that enabling the feature on a port automatically allows server traffic, rather than requiring an explicit 'trust' keyword.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The port is not configured as 'trusted' for DHCPv6 Guard, causing all server advertisements to be dropped.
When 'ipv6 dhcp guard' is enabled on a switch port, all DHCPv6 server advertisements (REPLY and ADVERTISE messages) are dropped by default unless the port is explicitly configured as 'trusted'. Since the server's port is untrusted, the switch drops the legitimate server's advertisements, causing the port to be err-disabled due to repeated violations. Configuring 'ipv6 dhcp guard trust' on the server-facing port resolves this issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The port is not configured as 'trusted' for DHCPv6 Guard, causing all server advertisements to be dropped.
Why this is correct
DHCPv6 Guard requires explicit trust for server ports.
- ✗
The DHCPv6 server is sending messages with an invalid DUID.
Why it's wrong here
Invalid DUID would not cause err-disable; it would just be ignored.
- ✗
DHCPv6 Guard only works with stateful DHCPv6, not stateless.
Why it's wrong here
DHCPv6 Guard works with both stateful and stateless.
- ✗
The switch is running an older IOS version that does not support DHCPv6 Guard.
Why it's wrong here
If unsupported, the command would be rejected.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.