Examkin

Question

Difficulty: EasyLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network administrator enables Dynamic ARP Inspection (DAI) on a switch access VLAN to mitigate ARP spoofing attacks. Which database does DAI consult by default to validate ARP requests and responses received on untrusted ports?

  1. The DHCP snooping binding databaseAnswer
  2. B
    The switch MAC address table
  3. C
    The native VLAN configuration table
  4. D
    The default IP access control list table

Answer

The DHCP snooping binding database
Dynamic ARP Inspection (DAI) is designed to prevent man-in-the-middle ARP spoofing attacks. When DAI is enabled on a VLAN, it intercepts all ARP requests and responses on untrusted ports and checks the sender IP address and sender MAC address against valid entries in the DHCP snooping binding database. If the IP-to-MAC binding does not match an entry in the database, the invalid ARP packet is dropped.

Step-by-Step Solution

1
Identify the primary function of Dynamic ARP Inspection (DAI)
DAI mitigates ARP poisoning/spoofing by intercepting and validating ARP requests and responses on untrusted switch ports.
Untrusted ports can receive malicious ARP messages attempting to misassociate IP addresses with attacker MAC addresses.
2
Determine the data source used by DAI for validation
DAI compares the sender IP address and MAC address in intercepted ARP packets against valid IP-to-MAC pairs.
DHCP Snooping dynamically builds and maintains the binding database containing MAC address, IP address, lease time, binding type, VLAN number, and interface information.

Key Concept

Dynamic ARP Inspection (DAI) operational dependency on DHCP Snooping
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic