A customer wants to prevent 'man-in-the-middle' attacks based on Layer 2 addressing. What will help address that concern?

Question

Options

• AEnable ARP inspection in the VLAN interface context
• BEnable ARP inspection in the VLAN context
• CEnable ARP inspection in the global context
• DEnable ARP inspection in interface-level context

• A
  14% (6)
• B
  77% (34)
• C
  7% (3)
• D
  2% (1)

Explanation

Dynamic ARP Inspection (DAI) is the defense against ARP spoofing - a Layer 2 man-in-the-middle attack where an attacker sends forged ARP replies to poison MAC-to-IP mappings. DAI must be enabled in the VLAN context (e.g., ip arp inspection vlan 10) because ARP operates within VLANs and the protection scope is per-VLAN, not per-interface or system-wide.

Why the distractors are wrong:

• A (VLAN interface context): This refers to configuring an SVI (interface vlan X), which handles routed traffic - not where DAI is enabled.
• C (global context): Enabling DAI globally without specifying a VLAN isn't how the feature works; you must target specific VLANs.
• D (interface-level context): Interface-level ARP inspection config exists (marking ports as trusted with ip arp inspection trust), but that's a secondary step - the feature itself is activated at the VLAN level.

Memory tip: "ARP lives in the VLAN - protect it there." DAI = Dynamic ARP Inspection = per-VLAN activation. If you see "interface-level," remember that's only for trust designation, not enabling DAI itself.

No community discussion yet for this question.