Which feature filters IPv6 traffic on untrusted Layer 2 ports?

IPv6 Source Guard is the correct answer because it filters IPv6 traffic on Layer 2 ports by verifying the source IPv6 address and MAC address against a binding table. This prevents unauthorized devices from spoofing legitimate IPv6 addresses, thereby protecting against various attacks like address spoofing and denial-of-service. Binding Table Recovery is incorrect as it's a mechanism to restore the binding table after a device restart, not a filtering feature. IPv6 RA Guard is incorrect because its primary function is to prevent rogue IPv6 router advertisements (RAs) from being broadcast, not to filter general IPv6 traffic based on source addresses. DHCPv6 Guard is incorrect because it protects against rogue DHCPv6 servers and clients, not general IPv6 source address spoofing.