Examkin

Question

Difficulty: MediumLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network administrator executes the commands `ip dhcp snooping` and `ip arp inspection vlan 10` on a Cisco Catalyst switch to mitigate Layer 2 ARP spoofing attacks. However, users on VLAN 10 immediately lose all network connectivity because Dynamic ARP Inspection (DAI) drops all incoming ARP requests from client ports. Executing `show ip dhcp snooping binding` displays an empty binding table. Which command was omitted from the switch configuration?

  1. ip dhcp snooping vlan 10Answer
  2. B
    ip arp inspection trust
  3. C
    copy running-config startup-config
  4. D
    switchport trunk native vlan 10

Answer

The missing command is 'ip dhcp snooping vlan 10'. Enabling DHCP Snooping globally is a two-step process: global activation followed by VLAN-specific activation.
Dynamic ARP Inspection (DAI) depends directly on the DHCP snooping binding database to inspect and validate ARP traffic arriving on untrusted ports. On Cisco Catalyst switches, turning on DHCP snooping globally using `ip dhcp snooping` does not activate DHCP snooping on any VLAN by default. The administrator must also issue `ip dhcp snooping vlan 10` to inspect DHCP packets on VLAN 10 and dynamically build the binding database.

Step-by-Step Solution

1
Analyze DAI dependencies
DAI inspects incoming ARP requests on untrusted ports by comparing sender IP and MAC addresses against valid entries in the Layer 2 DHCP snooping binding table.
Without valid entries in the binding database, DAI treats all incoming ARP requests on untrusted interfaces as invalid and drops them.
2
Identify the missing DHCP snooping feature configuration
Executing 'ip dhcp snooping' globally enables the feature framework on the switch, but snooping remains disabled on all VLANs until 'ip dhcp snooping vlan <vlan-id>' is configured.
Because VLAN 10 was not explicitly enabled for DHCP snooping, host lease requests were not intercepted, the binding table remained empty, and DAI dropped legitimate host ARP traffic.

Key Concept

DAI reliance on the DHCP Snooping Binding Database
Estimated Time:1m 30s
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic