CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  PortFast

  Why it's wrong here

  PortFast is a Spanning Tree Protocol (STP) enhancement that allows a switch port to transition directly to the forwarding state, bypassing the listening and learning states, to accelerate device boot-up in access ports. It has no mechanism to inspect or validate ARP messages, so it cannot resolve the IP-to-MAC mismatch caused by ARP spoofing; it only shortens the STP convergence time for end devices.

  When this WOULD be correct

  In a scenario where the question asks about optimizing switch port configurations for faster connectivity in a network with no concerns about security, PortFast would be the correct answer. For example, if the question specifies a need to reduce the time it takes for end devices to connect without mentioning security threats, PortFast would be appropriate.

• ✓

  Dynamic ARP Inspection

  Why this is correct

  Dynamic ARP Inspection (DAI) is a security feature on switches that intercepts all ARP requests and replies on untrusted ports and validates them against the DHCP snooping binding table. If the IP-to-MAC mapping in an ARP packet does not match the binding table, DAI drops the packet, thereby preventing ARP poisoning attacks. Additionally, DAI can rate-limit ARP packets to mitigate ARP-based denial-of-service attacks, making it the precise solution for the user's IP-to-MAC issue.

• ✗

  EtherChannel

  Why it's wrong here

  EtherChannel bundles multiple physical links into one logical link, providing load balancing and link redundancy at Layer 2, but it does not inspect or validate ARP packets. The IP-to-MAC binding issue described is an ARP spoofing problem, which EtherChannel cannot address because it operates purely at the link aggregation level, not at the protocol security layer.

  When this WOULD be correct

  In a scenario where a question asks about optimizing bandwidth and redundancy for a network segment while ensuring link aggregation, EtherChannel would be the correct answer. For example, if the question focuses on improving throughput between switches without addressing security concerns, EtherChannel would be appropriate.

• ✗

  NetFlow

  Why it's wrong here

  NetFlow is a flow-based accounting and monitoring tool that collects metadata about IP traffic, such as source/destination addresses and ports, enabling traffic analysis and anomaly detection post-facto. It does not actively intercept or validate ARP requests/replies, so it cannot prevent the ARP cache poisoning that causes incorrect IP-to-MAC mappings.

  When this WOULD be correct

  In a scenario where the exam question asks about monitoring and analyzing traffic patterns to identify unusual behavior or potential security threats, NetFlow would be the correct answer. For example, a question might focus on tools for traffic analysis in a network security context.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”