200-301 Question 441
Select 3You are tasked with configuring Layer 2 security features on a switch to mitigate potential attacks. The network administrator asks you to prevent rogue DHCP servers from assigning IP addresses while ensuring ARP traffic is validated against the DHCP snooping binding table. Which configuration steps should you implement?
- A
Enable DHCP snooping on the switch and configure trusted ports for legitimate DHCP servers
- B
Enable dynamic ARP inspection (DAI) on the switch and configure trusted ports for legitimate devices
- C
Disable DHCP snooping on the switch to allow ARP inspection to function independently
- D
Configure a static ARP table entry for all devices in the network to prevent ARP spoofing
- E
Ensure DHCP snooping is enabled on VLANs where ARP inspection is required
Show answer and explanation
Correct answers: A, B, E
Explanation
To mitigate attacks like rogue DHCP servers and ARP spoofing, DHCP snooping and dynamic ARP inspection (DAI) must be enabled. DHCP snooping prevents unauthorized DHCP servers from assigning IP addresses and creates a binding table of IP-to-MAC mappings. Dynamic ARP inspection uses this binding table to validate ARP packets. Trusted ports must be configured for legitimate devices and DHCP servers. Additionally, DHCP snooping must be enabled for VLANs where DAI is applied, as DAI relies on the DHCP snooping binding table.
- A. Correct.
Correct. Enabling DHCP snooping and configuring trusted ports ensures that rogue DHCP servers cannot assign IP addresses. This is a foundational step for protecting the network.
- B. Correct.
Correct. Enabling DAI and configuring trusted ports ensures that ARP traffic is validated against the DHCP snooping binding table, mitigating ARP spoofing attacks.
- C. Incorrect.
Incorrect. DHCP snooping must be enabled for dynamic ARP inspection to function properly since DAI relies on the DHCP snooping binding table.
- D. Incorrect.
Incorrect. Configuring static ARP table entries is impractical for large networks and does not leverage the dynamic protection provided by DHCP snooping and ARP inspection.
- E. Correct.
Correct. DAI relies on the DHCP snooping binding table, which means DHCP snooping must be enabled on the VLANs where DAI is applied.