Question 510 An IPv6 source-guard policy rejects legitimate host packets after a port move because the binding database still references the previous access port. Which technical mechanism best explains the behavior observed in this scenario? Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. ExplanationCorrect Answer B:IPv6 source guard checks packet source attributes against trusted learned or configured bindings. This explains why the initial condition produces the observed failure. The direct repair is: Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. Validate through: Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. Other Answers A:Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. C:IPv6 hosts can learn default routers from ICMPv6 Router Advertisements, which RA Guard can filter by port trust. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. D:Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. IPv6 source guard checks packet source attributes against trusted learned or configured bindings.
Question 511 An IPv6 source-guard policy rejects legitimate host packets after a port move because the binding database still references the previous access port. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Inspect blocked forged NA counters and stable legitimate router neighbor-cache entries. Show rogue DHCPv6 server replies blocked while approved server replies remain usable. Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. Verify server address/MAC/port binding and restored traffic while a spoofed host remains denied. ExplanationCorrect Answer C:Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: IPv6 source guard checks packet source attributes against trusted learned or configured bindings. Other Answers A:Inspect blocked forged NA counters and stable legitimate router neighbor-cache entries. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. B:Show rogue DHCPv6 server replies blocked while approved server replies remain usable. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. D:Verify server address/MAC/port binding and restored traffic while a spoofed host remains denied. IPv6 source guard checks packet source attributes against trusted learned or configured bindings.
Question 512 An IPv6 source-guard policy rejects legitimate host packets after a port move because the binding database still references the previous access port. Which lasting design or operational safeguard best prevents this particular issue from recurring? Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. Define RA Guard trusted-port policy in access-layer templates. Use layered IPv6 first-hop protection rather than assuming one guard feature covers every message type. Maintain binding lifecycle handling for endpoint mobility and access-port reassignments. ExplanationCorrect Answer D:Maintain binding lifecycle handling for endpoint mobility and access-port reassignments. This addresses the recurring cause: IPv6 source guard checks packet source attributes against trusted learned or configured bindings. A targeted acceptance check is: Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. Other Answers A:Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. B:Define RA Guard trusted-port policy in access-layer templates. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. C:Use layered IPv6 first-hop protection rather than assuming one guard feature covers every message type. IPv6 source guard checks packet source attributes against trusted learned or configured bindings.
Question 513 A switch sees forged IPv6 Neighbor Advertisements mapping the default router's IPv6 address to an attacker MAC; hosts lose connectivity. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Use supported Neighbor Discovery inspection with trusted bindings and validate enforcement for the access VLAN. Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. Use a separate RA Guard control in addition to DHCPv6 Guard; scope both to the access port role. Enable RA Guard on untrusted access ports while permitting router advertisements only on legitimate router-facing ports. ExplanationCorrect Answer A:Use supported Neighbor Discovery inspection with trusted bindings and validate enforcement for the access VLAN. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. Inspect blocked forged NA counters and stable legitimate router neighbor-cache entries. Other Answers B:Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. C:Use a separate RA Guard control in addition to DHCPv6 Guard; scope both to the access port role. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. D:Enable RA Guard on untrusted access ports while permitting router advertisements only on legitimate router-facing ports. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings.
Question 514 A switch sees forged IPv6 Neighbor Advertisements mapping the default router's IPv6 address to an attacker MAC; hosts lose connectivity. Which technical mechanism best explains the behavior observed in this scenario? Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. IPv6 source guard checks packet source attributes against trusted learned or configured bindings. ExplanationCorrect Answer B:Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. This explains why the initial condition produces the observed failure. The direct repair is: Use supported Neighbor Discovery inspection with trusted bindings and validate enforcement for the access VLAN. Validate through: Inspect blocked forged NA counters and stable legitimate router neighbor-cache entries. Other Answers A:Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. C:DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. D:IPv6 source guard checks packet source attributes against trusted learned or configured bindings. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings.
Question 515 A switch sees forged IPv6 Neighbor Advertisements mapping the default router's IPv6 address to an attacker MAC; hosts lose connectivity. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Capture RAs from the rogue access port being blocked and approved RAs still reaching hosts. Show rogue DHCPv6 server replies blocked while approved server replies remain usable. Inspect blocked forged NA counters and stable legitimate router neighbor-cache entries. Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. ExplanationCorrect Answer C:Inspect blocked forged NA counters and stable legitimate router neighbor-cache entries. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. Other Answers A:Capture RAs from the rogue access port being blocked and approved RAs still reaching hosts. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. B:Show rogue DHCPv6 server replies blocked while approved server replies remain usable. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. D:Confirm the new host-port-address binding and accepted legitimate IPv6 traffic after the move. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings.
Question 516 A switch sees forged IPv6 Neighbor Advertisements mapping the default router's IPv6 address to an attacker MAC; hosts lose connectivity. Which lasting design or operational safeguard best prevents this particular issue from recurring? Document approved router ports and require positive and negative RA tests. Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. Enable both IPv4 and IPv6 access-layer DHCP protections where dual stack is deployed. Deploy ND inspection with trustworthy binding acquisition and test address changes. ExplanationCorrect Answer D:Deploy ND inspection with trustworthy binding acquisition and test address changes. This addresses the recurring cause: Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. A targeted acceptance check is: Inspect blocked forged NA counters and stable legitimate router neighbor-cache entries. Other Answers A:Document approved router ports and require positive and negative RA tests. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. B:Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. C:Enable both IPv4 and IPv6 access-layer DHCP protections where dual stack is deployed. Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings.
Question 517 A security engineer enables RA Guard on every port, including the real upstream router link, and all IPv6 hosts lose their learned default gateway. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. Apply DHCPv6 Guard or equivalent IPv6 first-hop protection on untrusted access ports. Add supported static bindings or authorized binding-learning methods for the static hosts before enforcing source guard. ExplanationCorrect Answer A:Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. Observe authentic RAs reaching hosts and rogue access-port RAs remaining blocked. Other Answers B:Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. C:Apply DHCPv6 Guard or equivalent IPv6 first-hop protection on untrusted access ports. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. D:Add supported static bindings or authorized binding-learning methods for the static hosts before enforcing source guard. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router.
Question 518 A security engineer enables RA Guard on every port, including the real upstream router link, and all IPv6 hosts lose their learned default gateway. Which technical mechanism best explains the behavior observed in this scenario? DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. ExplanationCorrect Answer B:Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. This explains why the initial condition produces the observed failure. The direct repair is: Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. Validate through: Observe authentic RAs reaching hosts and rogue access-port RAs remaining blocked. Other Answers A:DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. C:Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. D:DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router.
Question 519 A security engineer enables RA Guard on every port, including the real upstream router link, and all IPv6 hosts lose their learned default gateway. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Inspect blocked forged NA counters and stable legitimate router neighbor-cache entries. Show rogue DHCPv6 server replies blocked while approved server replies remain usable. Observe authentic RAs reaching hosts and rogue access-port RAs remaining blocked. Verify that authorized DHCPv6 server replies arrive, without checking any Router Advertisements. ExplanationCorrect Answer C:Observe authentic RAs reaching hosts and rogue access-port RAs remaining blocked. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. Other Answers A:Inspect blocked forged NA counters and stable legitimate router neighbor-cache entries. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. B:Show rogue DHCPv6 server replies blocked while approved server replies remain usable. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. D:DHCPv6 success does not prove RA Guard permits only trusted routers or blocks forged RA messages. This RA Guard failure requires explicit accepted and blocked Router Advertisement observations.
Question 520 A security engineer enables RA Guard on every port, including the real upstream router link, and all IPv6 hosts lose their learned default gateway. Which lasting design or operational safeguard best prevents this particular issue from recurring? Maintain binding lifecycle handling for endpoint mobility and access-port reassignments. Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. Enable both IPv4 and IPv6 access-layer DHCP protections where dual stack is deployed. Document approved router ports and require positive and negative RA tests. ExplanationCorrect Answer D:Document approved router ports and require positive and negative RA tests. This addresses the recurring cause: Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. A targeted acceptance check is: Observe authentic RAs reaching hosts and rogue access-port RAs remaining blocked. Other Answers A:Maintain binding lifecycle handling for endpoint mobility and access-port reassignments. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. B:Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. C:Enable both IPv4 and IPv6 access-layer DHCP protections where dual stack is deployed. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router.
