Which action protects a network from VLAN hopping attacks?

Implementing port security primarily prevents unauthorized devices from connecting to a specific port and is not directly aimed at preventing VLAN hopping attacks that exploit trunking protocols.

VLAN hopping attacks often exploit the default configuration of the native VLAN, where untagged frames from an attacker can be forwarded to the native VLAN of the trunk. By changing the native VLAN ID to an unused or 'blackhole' VLAN and ensuring it is not used for any user traffic, an attacker cannot easily leverage this vulnerability to gain access to other VLANs.

Enabling dynamic ARP inspection (DAI) prevents ARP spoofing and poisoning attacks, which is a different type of network attack than VLAN hopping.

Configuring an ACL to prevent traffic from changing VLANs would restrict inter-VLAN routing, which is a different function and not a direct countermeasure to the mechanism of VLAN hopping attacks.