Which countermeasures can mitigate ARP spoofing attacks? (Choose two.)

Which countermeasures can mitigate ARP spoofing attacks? (Choose two.)
A . Port security
B . DHCP snooping
C . IP source guard
D . Dynamic ARP inspection

View Answer

Answer: B,D

Explanation:

+ ARP spoofing attacks and ARP cache poisoning can occur because ARP allows a gratuitous reply from a host even if an ARP request was not received.

+ DAI is a security feature that validates ARP packets in a network. DAI intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings. This capability protects the network from some man-in-the- middle attacks.

+ DAI determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database, the DHCP snooping binding database.

Source: Cisco Official Certification Guide, Dynamic ARP Inspection, p.254