Company ABC uses IPv4-only. Recently they started deploying new endpoint devices. For operational reasons, IPv6 cannot be disabled on these new endpoint devices. Which security measure prevents the…

Source Guard validates source IP addresses against a binding table to prevent spoofing, and Prefix Guard filters specific prefixes within RA messages, but neither combination comprehensively blocks rogue RA messages from attacker-controlled hosts the way RA Guard does at the port level.

Router Advertisement Guard is a Cisco first-hop IPv6 security feature deployed on access layer switches that inspects and filters IPv6 Router Advertisement messages, dropping any RA from untrusted ports such as those connected to end devices or attackers. By restricting which ports are allowed to source RA messages, endpoint devices only receive prefix information from legitimate upstream routers. This directly solves the scenario where IPv6 cannot be disabled but rogue prefix advertisement must be prevented.

Prefix Guard is a sub-feature that operates within the RA Guard framework to filter specific prefix values, but it cannot function as a standalone mechanism to block unsolicited RA messages from untrusted sources.

Secure Neighbor Discovery uses cryptographic signatures to authenticate NDP messages but is rarely supported on endpoint devices, operationally complex to deploy, and not a practical solution for blocking rogue IPv6 prefix advertisements in enterprise environments.