When designing a network, which two security features should be added to the design to protect hosts from potential IPv6 neighbor discovery denial of service attacks at the access layer? (Choose two.)

SEND (Secure Neighbor Discovery), defined in RFC 3971, uses Cryptographically Generated Addresses (CGAs) and RSA digital signatures to authenticate NDP messages, preventing spoofed Neighbor Advertisements and rogue Router Advertisements that attackers use to redirect traffic or cause denial of service.

RA Guard, defined in RFC 6105, is configured on access-layer switches to drop Router Advertisement messages arriving on ports not designated as router-facing, directly blocking rogue RA attacks that can corrupt host default gateway assignments and cause denial of service.

IKEv2 is a key exchange protocol used to negotiate IPsec security associations for VPN tunnels and has no mechanism for filtering or authenticating NDP messages at the access layer.

IPsec secures IP-layer traffic between endpoints but does not inherently protect the NDP process itself from spoofed ICMPv6 ND messages injected at the local access layer.

DMVPNv6 is a WAN overlay VPN technology for scalable hub-and-spoke connectivity and has no role in protecting Neighbor Discovery from DoS attacks on local access-layer segments.