A network engineer is configuring Layer 2 security controls on access switches to protect against man-in-the-middle attacks and rogue server deployments. Which two statements accurately describe the operational behaviors of DHCP Snooping and Dynamic ARP Inspection (DAI)? (Select two.)
- By default, switch interfaces are in an untrusted state for both features, requiring incoming traffic on access ports to be validated against the binding database.Answer
- Dynamic ARP Inspection intercepts, logs, and discards ARP packets on untrusted ports that fail IP-to-MAC binding verification.Answer
- CEnabling sticky MAC learning automatically commits learned MAC addresses to the startup configuration in NVRAM without requiring an explicit save command.
- DEnabling Dynamic ARP Inspection automatically resolves and aligns native VLAN mismatches across 802.1Q trunk connections.
Answer
Switch interfaces default to an untrusted state for both features requiring binding database validation, and Dynamic ARP Inspection intercepts and drops invalid ARP packets received on untrusted ports.
Both DHCP Snooping and Dynamic ARP Inspection default all switch ports to an untrusted state, ensuring that unverified DHCP server messages and invalid ARP packets on access ports are intercepted and validated against the binding database. When DAI processes incoming ARP requests or responses on an untrusted port, it compares the packet's IP and MAC address pairing with the database, dropping any packets that do not match.
Step-by-Step Solution
Key Concept
Layer 2 Security Port Trust States and DAI Binding Validation