Examkin

Question

Difficulty: HardLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

An enterprise network administrator is deploying Layer 2 security controls across an access switch. The administrator configures DHCP Snooping and Dynamic ARP Inspection (DAI) on VLAN 15 to safeguard clients against rogue DHCP servers and ARP spoofing attacks. Which TWO statements accurately describe the operational requirements and behaviors of Dynamic ARP Inspection (DAI) in this environment?

  1. DAI intercepts and validates incoming ARP requests and responses on untrusted interfaces against the DHCP snooping binding database.Answer
  2. Uplink interfaces connected to core switches or default gateway routers must be designated as DAI trusted ports to allow legitimate ARP traffic without inspection.Answer
  3. C
    DAI validates host ARP entries by reading sticky MAC address tables saved in startup-config NVRAM rather than dynamic memory.
  4. D
    DAI requires trunk interfaces to use identical native VLAN configurations across switches to perform cross-VLAN ARP packet inspection.

Answer

The correct operational behaviors are that Dynamic ARP Inspection (DAI) intercepts and validates ARP packets on untrusted ports against the DHCP snooping binding table, and that switch uplink/gateway interfaces must be configured as trusted ports to allow valid infrastructure ARP traffic to bypass inspection.
Dynamic ARP Inspection (DAI) protects networks against Man-in-the-Middle ARP spoofing by intercepting all ARP requests and responses on untrusted interfaces and verifying their sender IP and MAC address pairs against the DHCP snooping binding database. Additionally, ports connected to trusted network infrastructure (such as default gateways and switch uplinks) must be configured as DAI trusted interfaces so legitimate network traffic is passed without being dropped.

Step-by-Step Solution

1
Analyze DAI untrusted port behavior
DAI intercepts incoming ARP packets on untrusted interfaces and compares the IP-and-MAC sender fields against the DHCP snooping binding database (or static ARP ACLs). Unmatched packets are dropped.
Untrusted ports are host-facing access ports where malicious ARP poisoning attacks might originate.
2
Analyze DAI trusted port role
Ports connected to authorized switches, routers, or servers bypass DAI validation checks.
Infrastructure ports carry traffic for multiple hosts or network devices that may not have dynamic DHCP bindings on the local switch, so inspecting them would result in false-positive packet drops.
3
Evaluate distractor mechanisms
DAI does not query Port Security NVRAM configurations nor does it require native VLAN alignment to inspect VLAN-specific ARP frames.
DAI relies specifically on Layer 2/3 IP-to-MAC mapping databases generated via DHCP Snooping.

Key Concept

Dynamic ARP Inspection (DAI) database binding dependencies and interface trust state roles.
Estimated Time:2m 0s
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic