Which statement correctly describes IPv6 RA Guard behavior?

IPv6 RA Guard is a security feature designed to prevent rogue IPv6 router advertisements (RAs) from being broadcast on a network segment, which could lead to man-in-the-middle attacks or incorrect network configurations. It operates by filtering RA messages based on a configured policy. However, RA Guard typically inspects traffic at Layer 2 and Layer 3. When IPv6 traffic is encapsulated within a tunnel (e.g., IPsec, GRE), the original IPv6 RA message is hidden within the tunnel's outer header. This encapsulation prevents RA Guard from inspecting the inner IPv6 packet and applying its filtering rules, making it unable to protect tunneled traffic. The other options are incorrect: "It filters rogue RA broadcasts from connected hosts" is a primary function of RA Guard, making this statement true but not the most correct description in the context of the question's implication of a limitation. "It is supported on the egress direction of the switch" is incorrect; RA Guard is typically configured on ingress ports to filter incoming RAs. "RA messages are allowed from the host port to the switch" is incorrect; RA Guard's purpose is to block unauthorized RA messages from host ports.