DHCP snooping is a great solution to prevent rogue DHCP servers on your network. Which security feature on switchers leverages the DHCP snooping database to help prevent man-in-the- middle attacks?

Spanning Tree Protocol (STP) prevents switching loops and broadcast storms in layer 2 networks but has no mechanism to inspect or validate ARP traffic.

DAI intercepts all ARP requests and replies on untrusted switch ports and validates each packet against the DHCP snooping binding database, which maps legitimate IP addresses to MAC addresses and physical ports. Packets with spoofed IP-to-MAC mappings are discarded before they can poison ARP caches, which is the core mechanism of layer 2 man-in-the-middle attacks. Because DAI is directly built on top of the DHCP snooping database, enabling DHCP snooping is a prerequisite for DAI to function.

Port security restricts which MAC addresses are allowed to communicate on a given switch port to prevent MAC flooding, but it does not inspect ARP packet contents or leverage the DHCP snooping database.

Layer 2 Attack Prevention Protocol (LAPP) is not a real or standardized Cisco security feature; it is a distracting fabricated option.