What is a characteristic of Dynamic ARP Inspection?

Question

Options

• ADAI determines the validity of an ARP packet based on valid IP to MAC address bindings from
• BIn a typical network, make all ports as trusted except for the ports connecting to switches, which
• CDAI associates a trust state with each switch.
• DDAI intercepts all ARP requests and responses on trusted ports only.

• A
  90% (53)
• B
  5% (3)
• C
  2% (1)
• D
  3% (2)

Explanation

Dynamic ARP Inspection To prevent ARP poisoning attacks such as the one described in the previous section, a switch must ensure that only valid ARP requests and responses are relayed. DAI prevents these attacks by intercepting all ARP requests and responses. Each of these intercepted packets is verified for valid MAC address to IP address bindings before the local ARP cache is updated or the packet is forwarded to the appropriate destination. Invalid ARP packets are dropped. DAI determines the validity of an ARP packet based on valid MAC address to IP address bindings stored in a trusted database. This database is built at runtime by DHCP snooping, provided that it is enabled on the VLANs and on the switch in question. In addition, DAI can also validate ARP packets against user-configured ARP ACLs in order to handle hosts that use statically configured DAI can also be configured to drop ARP packets when the IP addresses in the packet are invalid or when the MAC addresses in the body of the ARP packet do not match the addresses specified in the Ethernet header.

No community discussion yet for this question.