A security engineer reviews the table below: The engineer realizes there is an active attack occurring on the network. Which of the following would BEST reduce the risk of this attack reoccurring m…

Upgrading device firmware patches known software vulnerabilities but does not enforce per-port MAC address limits that would actively prevent flooding or starvation attacks.

Enabling port security on a switch restricts the number of valid MAC addresses allowed per port and triggers a violation response (shutdown or restrict) when the limit is exceeded. This directly mitigates MAC flooding attacks that overflow the CAM table and DHCP starvation attacks that use spoofed MAC addresses to exhaust the available address pool - both of which align with the anomalous network activity shown in the referenced table.

Increasing the DHCP pool size temporarily raises the threshold an attacker must exceed but does not stop the attack, as an attacker can simply request more leases using additional spoofed MAC addresses.

Disabling dynamic trunking protocol (DTP) prevents VLAN hopping attacks, which is a different class of network attack unrelated to MAC flooding or DHCP starvation.

Reducing DHCP lease length causes addresses to expire sooner but does not prevent an attacker from continuously requesting new leases with spoofed MACs, so the pool can still be exhausted.