400-007: Cisco Certified Design ExpertDemo

By Cisco · Question Mode

QuestionQ28

Security Design

A company has developed an IPv6-adoption plan for its campus network that requires dual-stack connectivity across the network. Campus users must have IPv6 connectivity to an HR management application, the first IPv6-only application hosted in the company’s data center.

Which two security mechanisms can prevent a malicious user from masquerading as the IPv6 gateway?

Choose two
  • A IPv6 RA guard
  • B IPv6 snooping
  • C IPv6 device tracking
  • D IPv6 address glean
  • E port ACLs
Explanation

IPv6 Router Advertisement Guard blocks or rejects unauthorized Router Advertisement messages, which prevents an endpoint from advertising itself as a default IPv6 router. A port ACL can likewise deny rogue ICMPv6 Router Advertisements received on untrusted user-facing ports. Router Advertisements supply hosts with default-router information, so filtering them prevents gateway impersonation.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!