A company has AOS-CX switches deployed in a two-tier topology that uses OSPF routing at the core. You need to prevent ARP poisoning attacks. To meet this need, what is one technology that you could…

Question

Options

• AARP inspection
• BOSPF passive interface
• CBPDU guard (protection)
• DDHCPv4 snooping
• EBPDU filtering

• A
  86% (30)
• B
  6% (2)
• C
  3% (1)
• E
  6% (2)

Explanation

The scenario involves AOS-CX switches in a two-tier topology (access and core layers) using OSPF routing at the core. The goal is to prevent ARP poisoning attacks on user VLANs at the access layer switches, where end-user devices connect. ARP poisoning (also known as ARP spoofing) is an attack where a malicious device sends fake ARP messages to associate its MAC address with the IP address of another device (e.g., the default gateway), allowing the attacker to intercept traffic. ARP Inspection (Dynamic ARP Inspection, DAI): This feature prevents ARP poisoning by validating ARP packets against a trusted database of IP-to-MAC bindings. On AOS- CX switches, ARP inspection uses the DHCP snooping binding table to verify that ARP messages come from legitimate devices. If an ARP packet does not match the binding table, it is dropped. DHCPv4 Snooping: This feature protects against rogue DHCP servers and builds a binding table of legitimate IP-to-MAC mappings by snooping DHCP traffic. The binding table is used by ARP inspection to validate ARP packets. DHCP snooping must be enabled before ARP inspection can function effectively, as it provides the trusted data for validation.

No community discussion yet for this question.