A switch with Dynamic ARP Inspection enabled has received a spoofed ARP response on a trusted interface. How does the switch behave in this situation?

The correct answer is A. It forwards the packet without validation.. DAI determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database, the DHCP snooping binding database. This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the switch. If the ARP packet is receiv

Submitted by stefanr· Mar 30, 2026Network Security

Question

Options

AIt forwards the packet without validation.
BIt forwards the packet after validation by using the MAC Binding Table.
CIt drops the packet after validation by using the IP & MAC Binding Table.
DIt drops the packet without validation.

How the community answered

(49 responses)

A
84% (41)
B
6% (3)
C
2% (1)
D
8% (4)

Explanation

DAI determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database, the DHCP snooping binding database. This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the switch. If the ARP packet is received on a trusted interface, the switch forwards the packet without any checks. On untrusted interfaces, the switch forwards the packet only if it is valid.

Topics

#Dynamic ARP Inspection#trusted interface#ARP spoofing#Layer 2 security

Community Discussion

No community discussion yet for this question.

Full 350-701 Practice