200-301 Question 408
Select 3A network administrator is configuring a switch to improve security by preventing MAC address spoofing attacks. Which of the following techniques should the administrator implement?
- A
Port Security
- B
VLAN Hopping
- C
Dynamic ARP Inspection (DAI)
- D
Spanning Tree Protocol (STP)
- E
DHCP Snooping
Show answer and explanation
Correct answers: A, C, E
Explanation
To prevent MAC address spoofing, techniques such as Port Security, Dynamic ARP Inspection (DAI), and DHCP Snooping are essential. Port Security limits and validates MAC addresses, while DAI and DHCP Snooping ensure ARP and DHCP integrity by preventing invalid or spoofed address assignments. VLAN Hopping and STP are unrelated to addressing this specific threat.
- A. Correct.
Port Security can be used to limit the number of MAC addresses on a port and specify allowed MAC addresses, which helps prevent MAC address spoofing.
- B. Incorrect.
VLAN Hopping is a type of attack, not a security technique. It is unrelated to preventing MAC address spoofing.
- C. Correct.
Dynamic ARP Inspection (DAI) uses DHCP snooping binding tables to validate ARP packets, which helps prevent MAC address spoofing and ARP poisoning.
- D. Incorrect.
Spanning Tree Protocol (STP) is used to prevent network loops and does not address MAC address spoofing.
- E. Correct.
DHCP Snooping creates a database of trusted MAC-to-IP bindings, which can be used by features like DAI to prevent spoofing attacks.