A network security architect is reviewing threat vectors and host-level network attacks targeting a corporate access layer switch. The audit identifies that an attacker connected to an untrusted port successfully performed ARP poisoning to intercept traffic between local hosts and launched a rogue DHCP server to distribute malicious default gateway addresses to clients. Which two mitigation controls directly address these specific security vulnerabilities? (Select two.)
- Enable Dynamic ARP Inspection on untrusted access ports to validate ARP request and reply packets against the DHCP snooping binding database.Answer
- BEnable PortFast on inter-switch trunk links to instantly block malicious ARP packet floods and prevent network reconnaissance scans.
- Implement DHCP Snooping across access switches and configure uplink interfaces connected to authorized network servers as trusted ports.Answer
- DDeploy RADIUS authentication to encrypt the entire IP packet payload during authorization and command accounting transactions.
Answer
Enabling Dynamic ARP Inspection on untrusted access ports and implementing DHCP Snooping with trusted uplink interfaces directly mitigate ARP poisoning and rogue DHCP server attacks.
Dynamic ARP Inspection prevents ARP spoofing by intercepting ARP traffic on untrusted interfaces and verifying IP-to-MAC bindings against the DHCP snooping database. DHCP Snooping prevents unauthorized hosts from acting as DHCP servers by dropping server messages on untrusted ports while allowing legitimate leases through trusted ports.
Step-by-Step Solution
Key Concept
Layer 2 Threat Mitigation Mechanisms: Dynamic ARP Inspection (DAI) and DHCP Snooping