200-301: Cisco Certified Network AssociateDemo

By Cisco · Question Mode

QuestionQ1360

Security Fundamentals

A network administrator is assessing network security after an attempted ARP spoofing attack.

If Port-channel1 is the uplink interface of the access-layer switch toward the distribution-layer switch, which two configurations must be applied on the access-layer switch to provide adequate protection?

Choose two
  • A ip dhcp snooping vlan 1-4094!interface Port-channel1switchport protectedswitchport port-security maximum 1
  • B ip dhcp snooping vlan 1-4094ip dhcp snooping!interface Port-channel1ip dhcp snooping trust
  • C ip dhcp snooping!interface Port-channel1switchport port-security maximum 1switchport port-security
  • D ip arp inspection trust!interface Port-channel1switchport port-security maximum 4094switchport port-securityip verify source mac-check
  • E ip arp inspection vlan 1-4094!interface Port-channel1ip arp inspection trust
Explanation

Dynamic ARP Inspection is the Cisco feature that protects against ARP spoofing, and it relies on the DHCP snooping binding database to validate IP-to-MAC mappings. Therefore, the switch must have DHCP snooping enabled for the relevant VLANs, and the uplink toward another switch should be configured as a trusted DHCP snooping interface. ARP inspection must also be enabled for the VLANs, and that same uplink should be marked as a trusted ARP inspection interface so legitimate upstream ARP traffic is not blocked. This maps to the configuration in B for DHCP snooping and E for ARP inspection. Official Cisco documentation states that DAI uses the DHCP snooping binding database and that trusted interfaces are configured with ip arp inspection trust.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!