350-401 Question 573
Single answerYou are configuring IPv6 security features on an enterprise network. A rogue device is attempting to send fake Router Advertisement (RA) messages to disrupt network operations. Which IPv6 First Hop Security feature should you implement to mitigate this specific threat?
- A
RA Guard
- B
DHCP Guard
- C
Binding Table
- D
ND Inspection/Snooping
Show answer and explanation
Correct answer: A
Explanation
RA Guard is the appropriate IPv6 First Hop Security feature to block unauthorized or rogue Router Advertisement messages. It operates by filtering RA messages at the switch port level, ensuring that only legitimate RA messages are forwarded. This makes it an effective defense against attacks that exploit the Router Advertisement functionality in IPv6 networks.
- A. Correct.
RA Guard is specifically designed to block unauthorized or rogue Router Advertisement messages, making it the correct solution for this threat.
- B. Incorrect.
DHCP Guard is used to prevent rogue DHCP servers from issuing IPv6 addresses, but it does not address the issue of rogue Router Advertisement messages.
- C. Incorrect.
Binding Table is part of the IPv6 First Hop Security framework, but it is primarily used to track valid IPv6 addresses and bindings rather than mitigating RA-based threats.
- D. Incorrect.
ND Inspection/Snooping helps protect against Neighbor Discovery Protocol (NDP)-based attacks such as spoofing or DoS, but it does not specifically target rogue Router Advertisement messages.