A port authority needs to block unauthorized DHCPv6 servers on the same Layer-2 segment as legitimate clients. Which control parallels IPv4 DHCP snooping’s goal for IPv6?
Select an answer to reveal the explanation.
Short Explanation
DHCPv6 Guard is snooping’s IPv6 cousin—only trusted ports may hand out v6 leases. A rogue DHCPv6 box on an access port gets muted.
Full Explanation
DHCPv6 Guard (IPv6 DHCP Guard) classifies ports as server/client or trusted/untrusted equivalents so unauthorized DHCPv6 replies cannot serve the segment—paralleling IPv4 DHCP snooping’s goal for a port authority blocking rogue DHCPv6 servers on the same L2 segment as legitimate clients.
IPv4 IP Source Guard does not automatically police IPv6 DHCP traffic. Private VLAN promiscuous mapping without IPv6 first-hop security does not filter rogue DHCPv6 servers. GRE keepalives on the underlay are not a DHCP server filter on the access segment.
Exam caveat: rogue DHCPv6 → DHCPv6 Guard; do not assume IPv4 IPSG covers IPv6 DHCP.
Operational check: enable DHCPv6 Guard with correct server/client roles, place a rogue DHCPv6 responder on an access port, confirm clients ignore/block it, and keep legitimate relays/servers on trusted ports. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services. Re-validate after the next platform or policy change. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.