An airport authority must stop rogue IPv6 Router Advertisements from appearing on access ports serving passenger and staff devices. Which feature is designed for that threat?
Select an answer to reveal the explanation.
Short Explanation
RA Guard is the ‘authorized routers only’ sign for IPv6. Access ports can’t spew fake Router Advertisements that yank hosts toward a rogue gateway.
Full Explanation
IPv6 Router Advertisement Guard filters RAs so only trusted ports or properly role-classified ports may forward them, protecting passenger and staff devices from malicious prefix and gateway information. An airport authority stopping rogue RAs on access ports needs RA Guard as the purpose-built first-hop IPv6 control for that threat.
IPv4 DHCP snooping alone without IPv6 first-hop controls does not stop rogue RAs. PIM sparse-mode RP anycast for neighbor discovery misuses multicast RP design as an ND defense. Storm control on OSPFv3 hellos at the WAN edge does not replace RA Guard on access ports serving hosts.
Exam caveat: rogue RA on access → RA Guard; IPv4 DHCP snooping is not a substitute.
Operational check: classify trusted router ports versus access ports, enable RA Guard, inject a rogue RA in a lab VLAN, confirm hosts are unaffected, and monitor drops on airport access edges. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services. Re-validate after the next platform or policy change. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.