Company ABC uses IPv4-only. Recently, they started deploying new endpoint devices. For operational reasons, IPv6 cannot be disabled on these new endpoint devices. Which security measure prevents the n

Secure Neighbor Discovery (SEND) uses cryptographic certificates to authenticate NDP messages, but it requires PKI infrastructure and client-side support on every endpoint, making it impractical for simply blocking rogue RA messages in this scenario.

RA Guard is an IPv6 first-hop security feature implemented on Layer 2 switches that inspects and drops IPv6 Router Advertisement messages arriving on ports not designated as router-facing. Since endpoints learn their IPv6 prefix and default gateway from RA messages, blocking rogue RAs at the switch level prevents an attacker from injecting fake prefixes into the segment. This targeted control operates transparently to the endpoint devices, which is critical when IPv6 cannot be disabled on them.

Prefix Guard is not a standalone standard IPv6 security feature - it is a component within DHCPv6 Guard and related mechanisms, and it does not independently prevent endpoints from learning prefixes from rogue Router Advertisements.

Source Guard filters traffic based on validated source IP and MAC bindings from DHCP snooping tables and does not address the threat of rogue Router Advertisement messages assigning unauthorized IPv6 prefixes to endpoints.