nerdexam
Cisco

300-320 · Question #577

An engineer has to increase the security in the core network. What needs to be implemented to be sure that the IP traffic is originating from the correct network segment?

The correct answer is D. ARP inspection. Dynamic ARP Inspection (DAI) validates ARP packets by checking them against the DHCP snooping binding table, which maps IP addresses to MAC addresses and switch ports. This ensures that an IP address is being used by the legitimate host assigned to that segment. If a device…

Security Services

Question

An engineer has to increase the security in the core network. What needs to be implemented to be sure that the IP traffic is originating from the correct network segment?

Options

  • AIPS
  • BACL
  • CVLAN access lists
  • DARP inspection

How the community answered

(35 responses)
  • A
    6% (2)
  • B
    3% (1)
  • D
    91% (32)

Explanation

Dynamic ARP Inspection (DAI) validates ARP packets by checking them against the DHCP snooping binding table, which maps IP addresses to MAC addresses and switch ports. This ensures that an IP address is being used by the legitimate host assigned to that segment. If a device attempts to send traffic using an IP address that does not match its binding (i.e., traffic originating from the wrong network segment or a spoofed address), DAI drops the ARP packet, preventing the attack. IPS (A) detects/blocks threats but does not validate IP-to-segment origin. ACLs (B) can filter traffic but cannot verify source legitimacy at the ARP/MAC level. VLAN access lists (C) control traffic between VLANs but do not validate IP origin. DAI directly addresses IP spoofing within a network segment.

Topics

#ARP inspection#IP source verification#Layer 2 security#network security

Community Discussion

No community discussion yet for this question.

Full 300-320 Practice