Which statement about IPv6 RA Guard is true?
Choose an answer
Tap an option to check your answer.
Correct answer: It does not provide protection when IPv6 traffic is tunneled..
Why this is the answer
IPv6 RA Guard inspects Router Advertisement (RA) messages to prevent rogue IPv6 routers from advertising themselves on the network. However, its inspection capabilities are limited to the IPv6 header and immediate payload. When IPv6 traffic is encapsulated within a tunnel (e.g., GRE, IPsec), the original IPv6 header is hidden within the tunnel’s outer header. RA Guard cannot inspect the inner encapsulated IPv6 packet, thus failing to provide protection. Incorrect options: RA Guard is typically configured on switch ports in the ingress direction to filter incoming RA messages. Packets dropped by RA Guard can still be mirrored (spanned) for analysis, as mirroring operates independently of the packet drop decision. RA Guard can be supported in hardware, leveraging TCAM for efficient lookup and filtering rules.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed