Which two best practices for the security design of an IPv6 network are true? (Choose two.)

BGP and IS-IS support cryptographic authentication methods such as MD5 and SHA-HMAC regardless of whether IPv6 is enabled, so they are not limited to unencrypted passwords.

ICMPv6 fulfills critical functions absent in ICMPv4 - such as Neighbor Discovery Protocol (NDP), Router Advertisements, and Multicast Listener Discovery - requiring firewall policies to permit specific ICMPv6 types that would be blocked under a typical ICMPv4 policy. Treating them identically would break core IPv6 functionality.

uRPF remains a necessary anti-spoofing control in IPv6 networks even with IPv6 First Hop Security (FHS) deployed, because FHS addresses link-local threats while uRPF validates source addresses at routed boundaries.

OSPFv3 removed the built-in authentication fields that existed in OSPFv2, leaving no native mechanism for authentication or encryption of routing updates. IPsec must be applied directly to OSPFv3 interfaces to provide integrity and confidentiality when security is required.

Host-level security controls only protect the individual device and cannot inspect or block IPv6 traffic transiting the network between other devices, making network-level enforcement mandatory.