352-001 · Question #423
Which statement about DHCPv6 Guard features design is true?
The correct answer is C. Rogue DHCPv6 servers cannot assign IPv6 addresses to clients. DHCPv6 Guard is a first-hop security feature that blocks DHCPv6 server messages on untrusted ports, preventing rogue servers from assigning addresses.
Question
Which statement about DHCPv6 Guard features design is true?
Options
- AA certificate must be installed on the DHCPv6 server and relay agent.
- BDHCPv6 client requests can be rate-limited to protect the control plane.
- CRogue DHCPv6 servers cannot assign IPv6 addresses to clients.
- DDHCPv6 client requests can be filtered to protect the data plane.
How the community answered
(21 responses)- A5% (1)
- C90% (19)
- D5% (1)
Why each option
DHCPv6 Guard is a first-hop security feature that blocks DHCPv6 server messages on untrusted ports, preventing rogue servers from assigning addresses.
DHCPv6 Guard is a port-based filtering mechanism and requires no certificate infrastructure on either the server or relay agent.
Rate-limiting client requests is a function of control-plane policing (CoPP), not DHCPv6 Guard, which focuses on filtering server-originated messages.
DHCPv6 Guard works by classifying switch ports as trusted or untrusted, and only allowing DHCPv6 server reply messages (Advertise, Reply, Reconfigure) on trusted ports. Any DHCPv6 server response arriving on an untrusted port is dropped, ensuring rogue servers cannot assign IPv6 addresses to clients. This is the core design purpose of the DHCPv6 Guard feature.
DHCPv6 Guard operates on control-plane messaging (DHCPv6 signaling), not on the data plane, and it filters server responses rather than client requests.
Concept tested: DHCPv6 Guard rogue server prevention on untrusted ports
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16/ip6f-xe-16-book/ip6-dhcpv6-guard.html
Topics
Community Discussion
No community discussion yet for this question.