Question 520 A security engineer enables RA Guard on every port, including the real upstream router link, and all IPv6 hosts lose their learned default gateway. Which lasting design or operational safeguard best prevents this particular issue from recurring? Maintain binding lifecycle handling for endpoint mobility and access-port reassignments. Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. Enable both IPv4 and IPv6 access-layer DHCP protections where dual stack is deployed. Document approved router ports and require positive and negative RA tests. ExplanationCorrect Answer D:Document approved router ports and require positive and negative RA tests. This addresses the recurring cause: Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. A targeted acceptance check is: Observe authentic RAs reaching hosts and rogue access-port RAs remaining blocked. Other Answers A:Maintain binding lifecycle handling for endpoint mobility and access-port reassignments. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. B:Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router. C:Enable both IPv4 and IPv6 access-layer DHCP protections where dual stack is deployed. Overblocking legitimate Router Advertisements prevents SLAAC clients from learning a usable default router.
Question 521 An IPv6 first-hop policy depends on an incomplete snooping binding table, causing source guard to block statically addressed servers. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Add supported static bindings or authorized binding-learning methods for the static hosts before enforcing source guard. Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. Use supported Neighbor Discovery inspection with trusted bindings and validate enforcement for the access VLAN. Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. ExplanationCorrect Answer A:Add supported static bindings or authorized binding-learning methods for the static hosts before enforcing source guard. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. Verify server address/MAC/port binding and restored traffic while a spoofed host remains denied. Other Answers B:Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. C:Use supported Neighbor Discovery inspection with trusted bindings and validate enforcement for the access VLAN. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. D:Refresh validated IPv6 host bindings and verify the authoritative learning source for the new port. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic.
Question 522 An IPv6 first-hop policy depends on an incomplete snooping binding table, causing source guard to block statically addressed servers. Which technical mechanism best explains the behavior observed in this scenario? Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. ExplanationCorrect Answer B:Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. This explains why the initial condition produces the observed failure. The direct repair is: Add supported static bindings or authorized binding-learning methods for the static hosts before enforcing source guard. Validate through: Verify server address/MAC/port binding and restored traffic while a spoofed host remains denied. Other Answers A:Neighbor Discovery messages can poison neighbor caches unless inspection verifies legitimate address-to-link-layer mappings. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. C:DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. D:DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic.
Question 523 An IPv6 first-hop policy depends on an incomplete snooping binding table, causing source guard to block statically addressed servers. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Show rogue DHCPv6 server replies blocked while approved server replies remain usable. Observe authentic RAs reaching hosts and rogue access-port RAs remaining blocked. Verify server address/MAC/port binding and restored traffic while a spoofed host remains denied. Capture RAs from the rogue access port being blocked and approved RAs still reaching hosts. ExplanationCorrect Answer C:Verify server address/MAC/port binding and restored traffic while a spoofed host remains denied. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. Other Answers A:Show rogue DHCPv6 server replies blocked while approved server replies remain usable. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. B:Observe authentic RAs reaching hosts and rogue access-port RAs remaining blocked. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. D:Capture RAs from the rogue access port being blocked and approved RAs still reaching hosts. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic.
Question 524 An IPv6 first-hop policy depends on an incomplete snooping binding table, causing source guard to block statically addressed servers. Which lasting design or operational safeguard best prevents this particular issue from recurring? Maintain binding lifecycle handling for endpoint mobility and access-port reassignments. Document approved router ports and require positive and negative RA tests. Deploy ND inspection with trustworthy binding acquisition and test address changes. Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. ExplanationCorrect Answer D:Plan static and dynamic host binding coverage prior to IPv6 source-guard activation. This addresses the recurring cause: Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. A targeted acceptance check is: Verify server address/MAC/port binding and restored traffic while a spoofed host remains denied. Other Answers A:Maintain binding lifecycle handling for endpoint mobility and access-port reassignments. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. B:Document approved router ports and require positive and negative RA tests. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. C:Deploy ND inspection with trustworthy binding acquisition and test address changes. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic.
Question 525 The switch trust policy protects DHCPv6 server advertisements but not spoofed IPv6 router advertisements from a compromised PC. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Use a separate RA Guard control in addition to DHCPv6 Guard; scope both to the access port role. Apply DHCPv6 Guard or equivalent IPv6 first-hop protection on untrusted access ports. Use supported Neighbor Discovery inspection with trusted bindings and validate enforcement for the access VLAN. Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. ExplanationCorrect Answer A:Use a separate RA Guard control in addition to DHCPv6 Guard; scope both to the access port role. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. Verify both rogue DHCPv6 replies and forged RAs are independently blocked. Other Answers B:Apply DHCPv6 Guard or equivalent IPv6 first-hop protection on untrusted access ports. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. C:Use supported Neighbor Discovery inspection with trusted bindings and validate enforcement for the access VLAN. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. D:Mark only the authorized router-facing port as trusted while keeping untrusted user ports filtered. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements.
Question 526 The switch trust policy protects DHCPv6 server advertisements but not spoofed IPv6 router advertisements from a compromised PC. Which technical mechanism best explains the behavior observed in this scenario? DHCPv4 snooping by itself inspects and blocks all unauthorized IPv6 Router Advertisements. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. ExplanationCorrect Answer B:DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. This explains why the initial condition produces the observed failure. The direct repair is: Use a separate RA Guard control in addition to DHCPv6 Guard; scope both to the access port role. Validate through: Verify both rogue DHCPv6 replies and forged RAs are independently blocked. Other Answers A:DHCPv4 snooping does not replace IPv6 RA Guard. This case is about distinguishing DHCPv6 server filtering from ICMPv6 Router Advertisement filtering. C:DHCPv6 configuration messages are separate from IPv4 DHCP and need IPv6-aware admission controls. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. D:Dynamic binding databases might not learn all static IPv6 addresses; enforcement without complete bindings drops legitimate traffic. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements.
Question 527 The switch trust policy protects DHCPv6 server advertisements but not spoofed IPv6 router advertisements from a compromised PC. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Verify server address/MAC/port binding and restored traffic while a spoofed host remains denied. Inspect blocked forged NA counters and stable legitimate router neighbor-cache entries. Verify both rogue DHCPv6 replies and forged RAs are independently blocked. Observe authentic RAs reaching hosts and rogue access-port RAs remaining blocked. ExplanationCorrect Answer C:Verify both rogue DHCPv6 replies and forged RAs are independently blocked. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. Other Answers A:Verify server address/MAC/port binding and restored traffic while a spoofed host remains denied. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. B:Inspect blocked forged NA counters and stable legitimate router neighbor-cache entries. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. D:Observe authentic RAs reaching hosts and rogue access-port RAs remaining blocked. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements.
Question 528 The switch trust policy protects DHCPv6 server advertisements but not spoofed IPv6 router advertisements from a compromised PC. Which lasting design or operational safeguard best prevents this particular issue from recurring? Enable both IPv4 and IPv6 access-layer DHCP protections where dual stack is deployed. Disable IPv6 monitoring but continue accepting Router Advertisements on every user port. Use DHCPv6 Guard alone and assume that it automatically drops rogue ICMPv6 Router Advertisements. Use layered IPv6 first-hop protection rather than assuming one guard feature covers every message type. ExplanationCorrect Answer D:Use layered IPv6 first-hop protection rather than assuming one guard feature covers every message type. This addresses the recurring cause: DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. A targeted acceptance check is: Verify both rogue DHCPv6 replies and forged RAs are independently blocked. Other Answers A:Enable both IPv4 and IPv6 access-layer DHCP protections where dual stack is deployed. DHCPv6 Guard filters DHCPv6 server behavior, whereas RA Guard addresses ICMPv6 router advertisements. B:Disabling monitoring and leaving RAs unrestricted makes the rogue router problem worse; the protective design must cover RA Guard alongside DHCPv6 Guard. C:DHCPv6 Guard controls DHCPv6 server messages, not ordinary Router Advertisements. RA Guard or equivalent IPv6 first-hop controls are separately necessary.
Question 529 A new branch router responds to ping but rejects SSH even though transport input permits SSH; its VTY lines require login local and no local account exists. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Configure an appropriate local user with secret and privilege or bind the approved AAA method list. Verify SCP server capability and enable the supported SCP service with the required authentication/authorization. Migrate backup automation to an approved encrypted transfer such as SCP with restricted credentials. Enable supported SSHv2 and restrict VTY transport to SSH after confirming key and authentication readiness. ExplanationCorrect Answer A:Configure an appropriate local user with secret and privilege or bind the approved AAA method list. VTY `login local` authenticates against the device's local account database; network reachability alone is insufficient. Confirm a controlled SSH login and check VTY authentication settings without weakening access control. Other Answers B:Verify SCP server capability and enable the supported SCP service with the required authentication/authorization. VTY `login local` authenticates against the device's local account database; network reachability alone is insufficient. C:Migrate backup automation to an approved encrypted transfer such as SCP with restricted credentials. VTY `login local` authenticates against the device's local account database; network reachability alone is insufficient. D:Enable supported SSHv2 and restrict VTY transport to SSH after confirming key and authentication readiness. VTY `login local` authenticates against the device's local account database; network reachability alone is insufficient.
Question 530 A new branch router responds to ping but rejects SSH even though transport input permits SSH; its VTY lines require login local and no local account exists. Which technical mechanism best explains the behavior observed in this scenario? SCP rides over SSH but its server-side file-transfer capability can require distinct feature activation and privilege. VTY `login local` authenticates against the device's local account database; network reachability alone is insufficient. TFTP uses UDP exchanges and data ports that do not behave like a single persistent TCP session. Traditional FTP exposes control credentials and file contents unless specifically protected by a secure variant. ExplanationCorrect Answer B:VTY `login local` authenticates against the device's local account database; network reachability alone is insufficient. This explains why the initial condition produces the observed failure. The direct repair is: Configure an appropriate local user with secret and privilege or bind the approved AAA method list. Validate through: Confirm a controlled SSH login and check VTY authentication settings without weakening access control. Other Answers A:SCP rides over SSH but its server-side file-transfer capability can require distinct feature activation and privilege. VTY `login local` authenticates against the device's local account database; network reachability alone is insufficient. C:TFTP uses UDP exchanges and data ports that do not behave like a single persistent TCP session. VTY `login local` authenticates against the device's local account database; network reachability alone is insufficient. D:Traditional FTP exposes control credentials and file contents unless specifically protected by a secure variant. VTY `login local` authenticates against the device's local account database; network reachability alone is insufficient.
