352-001 · Question #560
As a part of a network design, you should tighten security to prevent man-in-the-middle. Which two security options ensure that authorized ARP responses take place according to know IP-to- MAC…
The correct answer is A. DHCP snooping D. Dynamic ARP Inspection. DHCP snooping builds the IP-to-MAC binding table, and Dynamic ARP Inspection (DAI) uses that table to validate ARP packets, together preventing ARP spoofing attacks.
Question
As a part of a network design, you should tighten security to prevent man-in-the-middle. Which two security options ensure that authorized ARP responses take place according to know IP-to- MAC address mapping? (Choose two)
Options
- ADHCP snooping
- BARP spoofing
- CARP rate limiting
- DDynamic ARP Inspection
- EPort security
How the community answered
(50 responses)- A94% (47)
- C4% (2)
- E2% (1)
Why each option
DHCP snooping builds the IP-to-MAC binding table, and Dynamic ARP Inspection (DAI) uses that table to validate ARP packets, together preventing ARP spoofing attacks.
DHCP snooping intercepts DHCP exchanges to build a trusted binding table mapping IP addresses to MAC addresses and switch ports; this database is the authoritative source DAI consults when validating ARP packets.
ARP spoofing is the attack vector being defended against, not a security control or mitigation technique.
ARP rate limiting throttles the volume of ARP packets to mitigate ARP flood attacks but does not validate IP-to-MAC mappings and cannot prevent spoofed ARP replies sent within the rate limit.
Dynamic ARP Inspection intercepts all ARP requests and replies on untrusted ports and drops any ARP packet whose IP-to-MAC mapping does not match the DHCP snooping binding table, directly preventing ARP spoofing and man-in-the-middle attacks.
Port security restricts which MAC addresses can communicate on a switchport but does not inspect ARP packet contents or validate IP-to-MAC bindings.
Concept tested: Dynamic ARP Inspection and DHCP snooping for ARP security
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-9/configuration_guide/sec/b_179_sec_9300_cg/configuring_dynamic_arp_inspection.html
Topics
Community Discussion
No community discussion yet for this question.