300-320 · Question #577
An engineer has to increase the security in the core network. What needs to be implemented to be sure that the IP traffic is originating from the correct network segment?
The correct answer is D. ARP inspection. Dynamic ARP Inspection (DAI) validates ARP packets by checking them against the DHCP snooping binding table, which maps IP addresses to MAC addresses and switch ports. This ensures that an IP address is being used by the legitimate host assigned to that segment. If a device…
Question
An engineer has to increase the security in the core network. What needs to be implemented to be sure that the IP traffic is originating from the correct network segment?
Options
- AIPS
- BACL
- CVLAN access lists
- DARP inspection
How the community answered
(35 responses)- A6% (2)
- B3% (1)
- D91% (32)
Explanation
Dynamic ARP Inspection (DAI) validates ARP packets by checking them against the DHCP snooping binding table, which maps IP addresses to MAC addresses and switch ports. This ensures that an IP address is being used by the legitimate host assigned to that segment. If a device attempts to send traffic using an IP address that does not match its binding (i.e., traffic originating from the wrong network segment or a spoofed address), DAI drops the ARP packet, preventing the attack. IPS (A) detects/blocks threats but does not validate IP-to-segment origin. ACLs (B) can filter traffic but cannot verify source legitimacy at the ARP/MAC level. VLAN access lists (C) control traffic between VLANs but do not validate IP origin. DAI directly addresses IP spoofing within a network segment.
Topics
Community Discussion
No community discussion yet for this question.