What is a practice that protects a network from VLAN hopping attacks?

Dynamic ARP Inspection (DAI) protects against ARP spoofing and poisoning attacks by validating ARP packets, not specifically against VLAN hopping.

While ACLs filter traffic between VLANs, they do not inherently prevent an attacker from manipulating VLAN tags to gain unauthorized access to a different VLAN, which is the core of a VLAN hopping attack.

VLAN hopping attacks often exploit the native VLAN by sending frames tagged with the native VLAN ID or by removing tags to make frames appear as native VLAN traffic. By assigning all access ports to explicit, non-native VLANs, and ensuring the native VLAN is unused or distinct, this common attack vector is mitigated.

Port security restricts the number of MAC addresses learned on a port to prevent MAC flooding and unauthorized devices, which is different from preventing VLAN tagging manipulation characteristic of VLAN hopping attacks, and applying it only to internet-facing VLANs is insufficient.