A data center engineer is hardening a Nexus 9000 access layer that supports a dual-stack IPv6 tenant network. Rogue IPv6 router advertisements from a compromised host in the VLAN have caused clients to install a malicious default gateway, redirecting traffic. Which First-Hop Security feature should the engineer deploy on the untrusted access ports to prevent unauthorized devices from sending Router Advertisement messages?