HPE7-A08 · Question #176
A small company with one CX-6300 switch, with hostname switch1, has implemented ARP inspection to prevent MITM attacks. They are implementing a new hypervisor with host address 10.100.100.10 and MAC…
The correct answer is A. Enable ARP inspection trust for interface 1/1/20. A hypervisor hosts many VMs, each with its own IP and MAC address. If ARP inspection is not configured correctly, the switch will see many different IP-MAC bindings arriving on the same physical port and will treat them as spoofing attempts, generating false positives. The…
Question
A small company with one CX-6300 switch, with hostname switch1, has implemented ARP inspection to prevent MITM attacks. They are implementing a new hypervisor with host address 10.100.100.10 and MAC address F4-6D-3F-24-76-51, connected to switch1’s port 1/1/20. This new server will host many VMs. What will help prevent false positives with ARP inspection?
Options
- AEnable ARP inspection trust for interface 1/1/20.
- BEnable ARP inspection trust for MAC F4-6D-3F-24-76-51 at the VLAN interface context.
- CEnable ARP inspection trust 10.100.100.10 at VLAN interface level context.
- DEnable ARP inspection trust IP 10.100.100.10 MAC F4-6D-3F-24-76-51 in the global context.
How the community answered
(22 responses)- A68% (15)
- B18% (4)
- C5% (1)
- D9% (2)
Explanation
A hypervisor hosts many VMs, each with its own IP and MAC address. If ARP inspection is not configured correctly, the switch will see many different IP-MAC bindings arriving on the same physical port and will treat them as spoofing attempts, generating false positives. The correct solution is to trust the hypervisor’s uplink port arp-inspection trust on interface 1/1/20. This allows all ARP traffic from VMs behind the hypervisor without requiring you to define every VM’s IP-MAC pair, which is not scalable.
Topics
Community Discussion
No community discussion yet for this question.