Examkin

Question

Difficulty: MediumKey Security Concepts, Threats, Vulnerabilities, and Mitigations

An analyst monitoring a campus switch network detects an active Man-in-the-Middle (MitM) attack where an unauthorized host broadcasts gratuitous ARP replies containing its own MAC address mapped to the IP address of the default gateway. Which Layer 2 security control should be implemented to prevent this specific threat by validating incoming ARP requests and responses against a trusted binding database?

  1. Dynamic ARP Inspection (DAI)Answer
  2. B
    TACACS+ full-payload traffic encryption
  3. C
    PortFast enabled across interswitch trunk links
  4. D
    Sticky Port Security saved to the startup configuration

Answer

Dynamic ARP Inspection (DAI) is the specific security control designed to validate ARP packets on untrusted switch ports against a trusted binding table to stop ARP spoofing.
Dynamic ARP Inspection (DAI) is a Layer 2 security feature designed explicitly to mitigate ARP poisoning and spoofing attacks. It intercepts all ARP requests and responses on untrusted switch ports and verifies that the IP-to-MAC mapping matches a valid entry in the DHCP snooping binding table before forwarding the packet.

Step-by-Step Solution

1
Analyze the threat scenario described in the stem.
The attack involves transmitting forged ARP responses to map the gateway IP to an attacker's MAC address (ARP spoofing / MitM).
Identifying the threat type narrows down the specific mitigation mechanism.
2
Evaluate mitigation controls capable of inspecting Layer 2 ARP payloads.
Dynamic ARP Inspection (DAI) intercepts ARP requests and responses on untrusted ports and verifies the MAC-to-IP binding against the DHCP snooping database.
DAI drops invalid ARP packets, neutralizing the ARP poisoning threat.

Key Concept

Mitigating ARP Spoofing and Man-in-the-Middle Attacks with Dynamic ARP Inspection
Rate this question

Topics

Key Security Concepts, Threats, Vulnerabilities, and Mitigations

More questions from this topic