Question 500 An engineer raises every CoPP policing rate to stop dropped SSH packets, and routing control-plane CPU saturates during a flood. Which lasting design or operational safeguard best prevents this particular issue from recurring? Review actual control-plane encapsulations before writing class-map ACLs. Include management-plane traffic in CoPP stress tests and change reviews. Capacity-plan SNMP burst behavior in control-plane policing templates. Apply class-specific change limits and control-plane capacity acceptance tests. ExplanationCorrect Answer D:Apply class-specific change limits and control-plane capacity acceptance tests. This addresses the recurring cause: Unrestricted broad CoPP rate increases can remove protection of the router CPU while masking a classifier error. A targeted acceptance check is: Under controlled load, verify SSH availability and stable CPU with other classes still dropping excess packets. Other Answers A:Review actual control-plane encapsulations before writing class-map ACLs. Unrestricted broad CoPP rate increases can remove protection of the router CPU while masking a classifier error. B:Include management-plane traffic in CoPP stress tests and change reviews. Unrestricted broad CoPP rate increases can remove protection of the router CPU while masking a classifier error. C:Capacity-plan SNMP burst behavior in control-plane policing templates. Unrestricted broad CoPP rate increases can remove protection of the router CPU while masking a classifier error.
Question 501 An unauthorized device sends IPv6 router advertisements on an access port and clients install its default gateway. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Enable RA Guard on untrusted access ports while permitting router advertisements only on legitimate router-facing ports. Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. Use a separate RA Guard control in addition to DHCPv6 Guard; scope both to the access port role. Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. ExplanationCorrect Answer A:Enable RA Guard on untrusted access ports while permitting router advertisements only on legitimate router-facing ports. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. Capture RAs from the rogue access port being blocked and approved RAs still reaching hosts. Other Answers B:Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. C:Use a separate RA Guard control in addition to DHCPv6 Guard; scope both to the access port role. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. D:Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust.
Question 502 An unauthorized device sends IPv6 router advertisements on an access port and clients install its default gateway. Which technical mechanism best explains the behavior observed in this scenario? Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. ExplanationCorrect Answer B:IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. This explains why the initial condition produces the observed failure. The direct repair is: Enable RA Guard on untrusted access ports while permitting router advertisements only on legitimate router-facing ports. Validate through: Capture RAs from the rogue access port being blocked and approved RAs still reaching hosts. Other Answers A:Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. C:IPv6 source guard checks packet source attributes against trusted learned or configured bindings. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. D:Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust.
Question 503 An unauthorized device sends IPv6 router advertisements on an access port and clients install its default gateway. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. Verify both rogue DHCPv6 replies and forged RAs are independently blocked. Capture RAs from the rogue access port being blocked and approved RAs still reaching hosts. Show rogue DHCPv6 server replies blocked while approved server replies remain usable. ExplanationCorrect Answer C:Capture RAs from the rogue access port being blocked and approved RAs still reaching hosts. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. Other Answers A:Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. B:Verify both rogue DHCPv6 replies and forged RAs are independently blocked. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. D:Show rogue DHCPv6 server replies blocked while approved server replies remain usable. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust.
Question 504 An unauthorized device sends IPv6 router advertisements on an access port and clients install its default gateway. Which lasting design or operational safeguard best prevents this particular issue from recurring? Deploy ND inspection with trustworthy binding acquisition and test address changes. Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. Document approved router ports and require positive and negative RA tests. Define RA Guard trusted-port policy in access-layer templates. ExplanationCorrect Answer D:Define RA Guard trusted-port policy in access-layer templates. This addresses the recurring cause: IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. A targeted acceptance check is: Capture RAs from the rogue access port being blocked and approved RAs still reaching hosts. Other Answers A:Deploy ND inspection with trustworthy binding acquisition and test address changes. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. B:Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. C:Document approved router ports and require positive and negative RA tests. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust.
Question 505 An attacker runs a rogue DHCPv6 server on a user VLAN and hands out DNS configuration; standard DHCPv4 snooping does not stop it. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Apply DHCPv6 Guard or equivalent IPv6 first-hop protection on untrusted access ports. Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. Use a separate RA Guard control in addition to DHCPv6 Guard; scope both to the access port role. ExplanationCorrect Answer A:Apply DHCPv6 Guard or equivalent IPv6 first-hop protection on untrusted access ports. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. Show rogue DHCPv6 server replies blocked while approved server replies remain usable. Other Answers B:Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. C:Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. D:Use a separate RA Guard control in addition to DHCPv6 Guard; scope both to the access port role. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls.
Question 506 An attacker runs a rogue DHCPv6 server on a user VLAN and hands out DNS configuration; standard DHCPv4 snooping does not stop it. Which technical mechanism best explains the behavior observed in this scenario? Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. ExplanationCorrect Answer B:DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. This explains why the initial condition produces the observed failure. The direct repair is: Apply DHCPv6 Guard or equivalent IPv6 first-hop protection on untrusted access ports. Validate through: Show rogue DHCPv6 server replies blocked while approved server replies remain usable. Other Answers A:Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. C:Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. D:IPv6 source guard checks packet source attributes against trusted learned or configured bindings. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls.
Question 507 An attacker runs a rogue DHCPv6 server on a user VLAN and hands out DNS configuration; standard DHCPv4 snooping does not stop it. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. Verify server address/MAC/port binding and restored traffic while a spoofed host remains denied. Show rogue DHCPv6 server replies blocked while approved server replies remain usable. Capture RAs from the rogue access port being blocked and approved RAs still reaching hosts. ExplanationCorrect Answer C:Show rogue DHCPv6 server replies blocked while approved server replies remain usable. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. Other Answers A:Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. B:Verify server address/MAC/port binding and restored traffic while a spoofed host remains denied. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. D:Capture RAs from the rogue access port being blocked and approved RAs still reaching hosts. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls.
Question 508 An attacker runs a rogue DHCPv6 server on a user VLAN and hands out DNS configuration; standard DHCPv4 snooping does not stop it. Which lasting design or operational safeguard best prevents this particular issue from recurring? Maintain binding lifecycle handling for endpoint mobility and access-port reassignments. Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. Define RA Guard trusted-port policy in access-layer templates. Enable both IPv4 and IPv6 access-layer DHCP protections where dual stack is deployed. ExplanationCorrect Answer D:Enable both IPv4 and IPv6 access-layer DHCP protections where dual stack is deployed. This addresses the recurring cause: DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. A targeted acceptance check is: Show rogue DHCPv6 server replies blocked while approved server replies remain usable. Other Answers A:Maintain binding lifecycle handling for endpoint mobility and access-port reassignments. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. B:Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. C:Define RA Guard trusted-port policy in access-layer templates. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls.
Question 509 An IPv6 source-guard policy rejects legitimate host packets after a port move because the binding database still references the previous access port. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. Use a separate RA Guard control in addition to DHCPv6 Guard; scope both to the access port role. Use supported Neighbor Discovery inspection with trusted bindings and validate enforcement for the access VLAN. ExplanationCorrect Answer A:Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. Other Answers B:Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. C:Use a separate RA Guard control in addition to DHCPv6 Guard; scope both to the access port role. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. D:Use supported Neighbor Discovery inspection with trusted bindings and validate enforcement for the access VLAN. IPv6 source guard checks packet source attributes against trusted learned or configured bindings.
Question 510 An IPv6 source-guard policy rejects legitimate host packets after a port move because the binding database still references the previous access port. Which technical mechanism best explains the behavior observed in this scenario? Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. ExplanationCorrect Answer B:IPv6 source guard checks packet source attributes against trusted learned or configured bindings. This explains why the initial condition produces the observed failure. The direct repair is: Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. Validate through: Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. Other Answers A:Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. C:IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. D:Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. IPv6 source guard checks packet source attributes against trusted learned or configured bindings.
