303-300 Question #114: Real Exam Question with Answer & Explanation

Question

Options

• AIt monitors the network for neighbor discovery messages from new IPv6 hosts and routers.
• BIt monitors remote hosts by periodically sending echo requests to them.
• CIt monitors the availability of a network link by querying network interfaces.
• DIt monitors the network for IPv4 nodes that have not yet migrated to IPv6.
• EIt monitors log files for failed login attempts in order to block traffic from offending network nodes.

Explanation

ndpmon stands for Neighbor Discovery Protocol Monitor - the name itself encodes the answer. It watches IPv6 NDP traffic to detect when new hosts and routers announce themselves on the network, helping administrators audit IPv6 activity and spot rogue devices.

Why the distractors are wrong:

• B describes a ping-based availability checker (e.g., fping or nagios)
• C describes a link-state monitor that queries interface status (e.g., tools using netlink or ifconfig)
• D is a fabricated concept - no standard tool passively hunts for "unmigrated IPv4 nodes" this way
• E describes an intrusion-prevention tool like fail2ban, which parses logs and blocks offending IPs

Memory tip: Break the name apart - ndp = Neighbor Discovery Protocol (the IPv6 mechanism for address resolution and router discovery), mon = monitor. If you remember that NDP is IPv6's replacement for ARP, option A becomes the only logical fit.

No community discussion yet for this question.