Question 269 of 1,389
CCNA Network Services and Security Practice Question
A switch has DHCP snooping enabled and Dynamic ARP Inspection enabled on VLAN 30. A printer with a static IP on VLAN 30 cannot communicate because its ARP packets are being dropped.
What is the best fix?
⚠ Common exam trap
A common exam trap is to disable Dynamic ARP Inspection entirely or trust the user-facing access port to fix ARP packet drops from static IP devices. Disabling DAI weakens the network’s ARP spoofing protection, which is against best practices and exam expectations. Trusting access ports is too broad and can allow malicious ARP traffic, defeating the purpose of DAI. The trap is that these options seem easier but compromise security, whereas the correct approach is to configure static ARP inspection entries or ARP ACLs for static IP devices to maintain security and functionality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a static ARP inspection entry or ARP ACL for the printer.
DAI relies on trusted bindings. Static-IP devices that are not learned through DHCP often require a static ARP ACL or equivalent trusted binding mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable DAI on all VLANs globally.
Why it's wrong here
Turning off DAI globally (on all VLANs) is a disproportionate response that removes ARP spoofing protection for every host, not just the printer. DAI is enabled per-VLAN, so you could simply disable it on the affected VLAN or use a static entry/ACL to allow the printer. Disabling it globally increases the attack surface significantly and is not necessary to solve a single device's problem.
When this WOULD be correct
In a scenario where a network administrator is troubleshooting a network-wide ARP spoofing issue and determines that DAI is overly restrictive across all VLANs, they may decide to disable DAI globally to restore normal ARP functionality for all devices, including printers.
- ✓
Configure a static ARP inspection entry or ARP ACL for the printer.
Why this is correct
A printer with a static IP never generates a DHCP lease, so DAI finds no matching binding entry and discards its ARP packets. By configuring a static ARP access-list entry or a static DHCP snooping binding, you give the switch an explicit IP-to-MAC mapping to validate the printer's ARP traffic. This targeted fix resolves the issue without reducing security for other hosts.
- ✗
Trust the user-facing printer access port for DHCP snooping and DAI.
Why it's wrong here
Configuring the switch port as trusted for DHCP snooping and DAI would disable ARP inspection and DHCP message validation on that access port, leaving it open to spoofing. Trust should be reserved for ports connecting to legitimate DHCP servers or upstream switches, not end devices. This approach also fails to add the printer's static IP/MAC mapping to the binding table, so the underlying validation failure persists.
When this WOULD be correct
In a scenario where a network is configured with multiple VLANs and DAI is enabled, but a specific port for a trusted device (like a server) needs to bypass DAI for legitimate traffic, trusting that port would be the correct answer. This would allow ARP packets from that trusted device to pass through without being inspected.
- ✗
Change the printer to use a larger MTU.
Why it's wrong here
Increasing the printer's MTU would not affect DAI's drop decision, because DAI validates the IP-to-MAC bindings inside ARP packets against the DHCP snooping database, not frame sizes. ARP frames are small and always fit within the standard 1518-byte Ethernet MTU, so jumbo-frame tuning is irrelevant to this failure. Thus, an MTU change is a red herring and would leave the printer's ARP packets denied.
When this WOULD be correct
In a different scenario where a network is experiencing fragmentation issues due to mismatched MTU settings, a question could ask for a solution to improve communication between devices. In that case, suggesting a larger MTU for the printer could be the correct answer to resolve packet fragmentation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure a static ARP inspection entry or ARP ACL for the printer.Correct answer▾
Why this is correct
A printer with a static IP never generates a DHCP lease, so DAI finds no matching binding entry and discards its ARP packets. By configuring a static ARP access-list entry or a static DHCP snooping binding, you give the switch an explicit IP-to-MAC mapping to validate the printer's ARP traffic. This targeted fix resolves the issue without reducing security for other hosts.
✗Disable DAI on all VLANs globally.Wrong answer — click to see why▾
Why this is wrong here
Disabling DAI globally removes ARP inspection from all VLANs, which is an overly broad solution that weakens security across the entire switch, not just for the printer's VLAN.
★ When this WOULD be the correct answer
In a scenario where a network administrator is troubleshooting a network-wide ARP spoofing issue and determines that DAI is overly restrictive across all VLANs, they may decide to disable DAI globally to restore normal ARP functionality for all devices, including printers.
Why candidates choose this
A student might think disabling DAI is a quick fix to stop ARP drops, but they overlook that DAI is a valuable security feature that should be selectively bypassed for static devices rather than disabled entirely.
✗Trust the user-facing printer access port for DHCP snooping and DAI.Wrong answer — click to see why▾
Why this is wrong here
Trusting the user-facing access port for DHCP snooping and DAI would allow all ARP traffic from that port to bypass inspection, which is too permissive and could permit ARP spoofing attacks from that port.
★ When this WOULD be the correct answer
In a scenario where a network is configured with multiple VLANs and DAI is enabled, but a specific port for a trusted device (like a server) needs to bypass DAI for legitimate traffic, trusting that port would be the correct answer. This would allow ARP packets from that trusted device to pass through without being inspected.
Why candidates choose this
A student might confuse 'trusting' a port with allowing a static device to communicate, but trust is typically applied to uplink ports (e.g., to routers or other switches), not to access ports where end devices connect.
✗Change the printer to use a larger MTU.Wrong answer — click to see why▾
Why this is wrong here
MTU (Maximum Transmission Unit) affects the size of data packets, not ARP packets. ARP packets are small and always fit within standard MTU, so changing MTU has no effect on DAI dropping ARP packets.
★ When this WOULD be the correct answer
In a different scenario where a network is experiencing fragmentation issues due to mismatched MTU settings, a question could ask for a solution to improve communication between devices. In that case, suggesting a larger MTU for the printer could be the correct answer to resolve packet fragmentation.
Why candidates choose this
A student might think that increasing MTU could help if packets are being dropped, but they confuse DAI's ARP validation with MTU-related fragmentation issues, which are unrelated.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.