Which IPv6 first-hop security feature helps minimize denial-of-service attacks?

IPv6 Destination Guard helps minimize denial-of-service (DoS) attacks by preventing hosts from sending traffic to destinations that are not reachable or valid on the local link. It achieves this by dropping packets destined for addresses that are not present in the device's Neighbor Discovery (ND) cache or that are not configured as valid local addresses. This prevents malicious hosts from flooding the network with traffic to non-existent destinations, thereby conserving network resources and preventing DoS. IPv6 Router Advertisement Guard (RA Guard) protects against rogue routers by validating Router Advertisement messages, but it doesn't directly prevent DoS from invalid destination traffic. DHCPv6 Guard protects against rogue DHCPv6 servers, which is a different security concern. IPv6 MAC address filtering can restrict access based on MAC addresses but doesn't specifically address the issue of invalid destination addresses for DoS prevention.