Examkin

Question

Difficulty: Very hardKey Security Concepts, Threats, Vulnerabilities, and Mitigations

An enterprise network experiences an internal security incident where an unauthorized host on access VLAN 10 poisons the ARP caches of adjacent endpoints by advertising its own MAC address as the default gateway. A network engineer must implement a Layer 2 mitigation strategy that intercepts, inspects, and validates ARP requests and responses against a trusted IP-to-MAC binding table built by DHCP snooping. Which security mechanism directly mitigates this threat?

  1. Dynamic ARP Inspection (DAI), which checks ARP packets on untrusted ports against the DHCP snooping binding database to discard spoofed ARP replies.Answer
  2. B
    Port Security with sticky MAC address learning enabled across switch trunk links to restrict invalid gateway frame propagation.
  3. C
    Standard IPv4 Access Control Lists (ACLs) applied inbound on the switch virtual interface (SVI) without explicit deny entries.
  4. D
    RADIUS authentication on switch access ports, which encrypts Layer 2 ARP payloads to prevent host spoofing.

Answer

Dynamic ARP Inspection (DAI), which checks ARP packets on untrusted ports against the DHCP snooping binding database to discard spoofed ARP replies.
Dynamic ARP Inspection (DAI) is a Layer 2 security feature that defends against ARP poisoning and spoofing attacks. When DAI is enabled on a VLAN, switch ports are designated as trusted or untrusted. DAI intercepts all ARP requests and responses on untrusted ports and verifies the IP-to-MAC address bindings against a database built by DHCP snooping. If the ARP packet contains invalid or spoofed mappings, DAI drops the packet.

Step-by-Step Solution

1
Identify the specific threat scenario
The attack involves ARP poisoning (cache poisoning), where a malicious host sends gratuitous or forged ARP responses linking the default gateway's IP address to its own MAC address, facilitating a Man-in-the-Middle (MitM) attack.
Understanding the attack vector at Layer 2 is critical for selecting the appropriate mitigation control.
2
Evaluate required mitigation mechanisms against Layer 2 threats
Dynamic ARP Inspection (DAI) is designed specifically to prevent ARP spoofing by inspecting ARP packets on untrusted interfaces.
DAI compares the incoming ARP packet's MAC and IP address fields against valid entries in the DHCP snooping binding database.
3
Distinguish DAI from other Layer 2 and AAA security controls
Port Security limits MAC address counts, ACLs filter Layer 3/4 headers, and RADIUS handles AAA, leaving DAI as the only feature that validates ARP frame integrity against DHCP snooping data.
A comprehensive security strategy relies on applying the correct feature to its corresponding vulnerability.

Key Concept

Mitigating Layer 2 ARP Poisoning Threats using Dynamic ARP Inspection (DAI) and DHCP Snooping
Rate this question

Topics

Key Security Concepts, Threats, Vulnerabilities, and Mitigations

More questions from this topic