350-701 · Question #808
A networking team must harden an organization's core switch against man-in-the-middle attacks. The team must use Dynamic ARP Inspection (DAI) on the switch to meet the security service. Which action…
The correct answer is C. Apply ARP access control lists (ACLs) for Dynamic ARP Inspection filtering. Dynamic ARP Inspection works by validating ARP packets to prevent man-in-the-middle (MITM) attacks. To do that, it requires a way to determine which ARP messages are valid. There are two main sources of valid ARP bindings: 1. DHCP snooping binding database (recommended and…
Question
A networking team must harden an organization's core switch against man-in-the-middle attacks. The team must use Dynamic ARP Inspection (DAI) on the switch to meet the security service. Which action must be taken next to complete the configuration of the Dynamic ARP Inspection feature?
Options
- AEnable Dynamic ARP Inspection logging for dropped packets
- BConfigure the ARP packet rate limiting feature
- CApply ARP access control lists (ACLs) for Dynamic ARP Inspection filtering
- DEnable Dynamic ARP Inspection error-disabled recovery
How the community answered
(21 responses)- A5% (1)
- B14% (3)
- C76% (16)
- D5% (1)
Explanation
Dynamic ARP Inspection works by validating ARP packets to prevent man-in-the-middle (MITM) attacks. To do that, it requires a way to determine which ARP messages are valid. There are two main sources of valid ARP bindings: 1. DHCP snooping binding database (recommended and dynamic) 2. ARP ACLs (manual and static) If DHCP snooping is not enabled or you're using static IPs, you must configure ARP ACLs to define legitimate IP-to-MAC mappings. These ACLs allow DAI to compare incoming ARP packets against known valid entries.
Topics
Community Discussion
No community discussion yet for this question.