CCNA Network Services and Security Practice Question
A switch has DHCP snooping enabled, but users still experience IP-to-MAC spoofing attacks. Which additional feature should be considered to help address that specific problem?
⚠ Common exam trap
Don't confuse general security features with those specifically designed to prevent ARP spoofing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic ARP Inspection
Dynamic ARP Inspection (DAI) validates ARP packets against trusted binding information learned through DHCP snooping, directly preventing IP-to-MAC spoofing. PortFast is used to speed up STP convergence and does not provide ARP security. EtherChannel aggregates multiple links for bandwidth and redundancy but does not inspect ARP traffic. NetFlow is a traffic accounting and monitoring tool, not a security control for ARP spoofing. Therefore, DAI is the correct additional feature to address IP-to-MAC spoofing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PortFast
Why it's wrong here
PortFast is a Spanning Tree Protocol (STP) enhancement that allows a switch port to transition directly to the forwarding state, bypassing the listening and learning states, to accelerate device boot-up in access ports. It has no mechanism to inspect or validate ARP messages, so it cannot resolve the IP-to-MAC mismatch caused by ARP spoofing; it only shortens the STP convergence time for end devices.
When this WOULD be correct
In a scenario where the question asks about optimizing switch port configurations for faster connectivity in a network with no concerns about security, PortFast would be the correct answer. For example, if the question specifies a need to reduce the time it takes for end devices to connect without mentioning security threats, PortFast would be appropriate.
- ✓
Dynamic ARP Inspection
Why this is correct
Dynamic ARP Inspection (DAI) is a security feature on switches that intercepts all ARP requests and replies on untrusted ports and validates them against the DHCP snooping binding table. If the IP-to-MAC mapping in an ARP packet does not match the binding table, DAI drops the packet, thereby preventing ARP poisoning attacks. Additionally, DAI can rate-limit ARP packets to mitigate ARP-based denial-of-service attacks, making it the precise solution for the user's IP-to-MAC issue.
- ✗
EtherChannel
Why it's wrong here
EtherChannel bundles multiple physical links into one logical link, providing load balancing and link redundancy at Layer 2, but it does not inspect or validate ARP packets. The IP-to-MAC binding issue described is an ARP spoofing problem, which EtherChannel cannot address because it operates purely at the link aggregation level, not at the protocol security layer.
When this WOULD be correct
In a scenario where a question asks about optimizing bandwidth and redundancy for a network segment while ensuring link aggregation, EtherChannel would be the correct answer. For example, if the question focuses on improving throughput between switches without addressing security concerns, EtherChannel would be appropriate.
- ✗
NetFlow
Why it's wrong here
NetFlow is a flow-based accounting and monitoring tool that collects metadata about IP traffic, such as source/destination addresses and ports, enabling traffic analysis and anomaly detection post-facto. It does not actively intercept or validate ARP requests/replies, so it cannot prevent the ARP cache poisoning that causes incorrect IP-to-MAC mappings.
When this WOULD be correct
In a scenario where the exam question asks about monitoring and analyzing traffic patterns to identify unusual behavior or potential security threats, NetFlow would be the correct answer. For example, a question might focus on tools for traffic analysis in a network security context.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Dynamic ARP InspectionCorrect answer▾
Why this is correct
Dynamic ARP Inspection (DAI) is a security feature on switches that intercepts all ARP requests and replies on untrusted ports and validates them against the DHCP snooping binding table. If the IP-to-MAC mapping in an ARP packet does not match the binding table, DAI drops the packet, thereby preventing ARP poisoning attacks. Additionally, DAI can rate-limit ARP packets to mitigate ARP-based denial-of-service attacks, making it the precise solution for the user's IP-to-MAC issue.
✗PortFastWrong answer — click to see why▾
Why this is wrong here
PortFast is a Spanning Tree Protocol feature that immediately transitions a port to forwarding state, bypassing listening and learning states. It does not perform any validation of ARP packets or prevent IP-to-MAC spoofing attacks.
★ When this WOULD be the correct answer
In a scenario where the question asks about optimizing switch port configurations for faster connectivity in a network with no concerns about security, PortFast would be the correct answer. For example, if the question specifies a need to reduce the time it takes for end devices to connect without mentioning security threats, PortFast would be appropriate.
Why candidates choose this
Students might confuse PortFast with a security feature because it is often used on access ports to speed up connectivity, but it has no role in ARP inspection.
✗EtherChannelWrong answer — click to see why▾
Why this is wrong here
EtherChannel is a link aggregation technology that combines multiple physical links into a single logical link to increase bandwidth and provide redundancy. It does not inspect or validate ARP packets, so it cannot prevent IP-to-MAC spoofing.
★ When this WOULD be the correct answer
In a scenario where a question asks about optimizing bandwidth and redundancy for a network segment while ensuring link aggregation, EtherChannel would be the correct answer. For example, if the question focuses on improving throughput between switches without addressing security concerns, EtherChannel would be appropriate.
Why candidates choose this
Students might think EtherChannel provides security through redundancy or load balancing, but it is purely a Layer 2 aggregation feature with no security functions.
✗NetFlowWrong answer — click to see why▾
Why this is wrong here
NetFlow is a network monitoring protocol that collects IP traffic statistics for analysis and troubleshooting. It provides visibility into traffic patterns but does not actively block or validate ARP packets, so it cannot prevent spoofing attacks.
★ When this WOULD be the correct answer
In a scenario where the exam question asks about monitoring and analyzing traffic patterns to identify unusual behavior or potential security threats, NetFlow would be the correct answer. For example, a question might focus on tools for traffic analysis in a network security context.
Why candidates choose this
Students may confuse NetFlow's traffic analysis capabilities with security features, thinking that monitoring can detect and prevent attacks, but NetFlow is passive and does not enforce security policies.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Lab: Configure DHCP Server on Router
Key term
Dynamic ARP Inspection
Dynamic ARP Inspection is a security feature that validates ARP packets on a network to prevent man-in-the-middle attacks by ensuring that only legitimate ARP messages are forwarded.
Key term
STP convergence
STP convergence is the process by which a network of switches using the Spanning Tree Protocol reaches a stable, loop-free topology after a change in the network.
About these practice questions
One of 1,450 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.