A network admin contacts you. He is concerned that ARP spoofing or poisoning might occur on his network. What are some things he can do to prevent it? Select the best answers.

Port security on managed switches restricts which MAC addresses are permitted per port, blocking an attacker from injecting forged ARP replies by preventing unauthorized MAC addresses from communicating on the segment.

ARPwatch continuously audits IP-to-MAC bindings and alerts administrators when unexpected changes are detected, enabling rapid identification and response to active ARP poisoning attempts.

Firewalls operate at Layer 3 and above and do not process ARP frames, which are Layer 2 broadcast messages confined to a local network segment and therefore invisible to firewall inspection.

Static ARP entries permanently bind specific IP addresses to known MAC addresses in the ARP cache, so malicious dynamic ARP replies cannot overwrite legitimate mappings, which is practical to maintain on small networks.

Assigning static IP addresses prevents IP conflicts but has no effect on ARP behavior, since an attacker can still broadcast fraudulent ARP replies mapping any IP to an attacker-controlled MAC address.