Refer to the exhibit. You have verified that AOS-CX Switch-1 has constructed an IP-to-MAC binding table in VLANs 10-19. Now you need to enable ARP inspection for the endpoint connected to Switch-1…

Question

Exhibit

Options

• AConfigure ARP inspection on VLANs 10-19 on Switch-2.
• BConfigure DHCP snooping on VLANs 10-19 on Switch-2.
• CConfigure Switch-1 uplinks as trusted ARP inspection ports.
• DCreate a static IP-to-MAC binding on Switch-1 for the DHCP server.

• A
  5% (2)
• B
  10% (4)
• C
  67% (28)
• D
  19% (8)

Explanation

When Dynamic ARP Inspection (DAI) is enabled on Switch-1, all ports default to untrusted, including the uplinks to the rest of the network. If the uplinks remain untrusted, legitimate ARP traffic arriving from upstream devices (routers, other switches) will be validated against Switch-1's local binding table - and dropped when no matching entry is found - causing immediate traffic disruption. Marking the uplinks as trusted first tells Switch-1 to pass ARP packets on those ports without inspection, preserving connectivity while still inspecting endpoint-facing ports.

Why the distractors are wrong:

• A - Configuring ARP inspection on Switch-2 is a separate action and does nothing to protect Switch-1's uplinks from dropping valid upstream ARP traffic.
• B - DHCP snooping on Switch-2 is irrelevant here; Switch-1 already has its binding table built, so adding snooping upstream doesn't prevent the uplink-trust problem.
• D - A static binding for the DHCP server doesn't solve the root issue; the problem isn't a missing binding entry, it's that untrusted uplink ports will drop all uninspected upstream ARP replies.

Memory tip: Think "trust the trunk first." Uplinks and trunk ports are always trusted manually in DAI - enable trust on the uplinks before you turn on ARP inspection for the VLANs, or you'll lock yourself out.

No community discussion yet for this question.