200-301: Cisco Certified Network AssociateDemo

VLAN hopping attacks commonly rely on switch spoofing through Dynamic Trunking Protocol (DTP) so an attacker port can negotiate a trunk and gain access to multiple VLANs. The proper mitigation is to statically configure only the ports that must be trunks and disable DTP negotiation, while keeping user-facing ports as access ports. Cisco documentation explicitly warns that DTP can create VLAN hopping vulnerabilities and recommends using manual trunk configuration with DTP disabled.