CCNA Network Services and Security Practice Question
Which three options are true regarding the operation of Dynamic ARP Inspection (DAI) on a Cisco switch? (Choose three.)
⚠ Common exam trap
Cisco often tests the misconception that DAI validates ARP packets using the MAC address table or ARP cache, when in fact it strictly relies on the DHCP snooping binding database.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DAI validates ARP packets based on the DHCP snooping binding database.
Dynamic ARP Inspection (DAI) validates ARP packets by intercepting them on untrusted ports and checking the MAC-to-IP address binding against the DHCP snooping binding database. If the binding is invalid or missing, DAI drops the packet, preventing ARP spoofing attacks. This is why all three statements are correct: DAI relies on the DHCP snooping database, drops invalid bindings, and is enabled on untrusted ports facing end hosts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DAI validates ARP packets based on the DHCP snooping binding database.
Why this is correct
Dynamic ARP Inspection intercepts all ARP packets on untrusted ports and verifies that the source MAC address, source IP address, and interface in the ARP packet match a valid entry in the DHCP snooping binding database. Because this database is populated by DHCP snooping, only clients that received an IP address via DHCP are trusted, and static hosts must be manually configured. This prevents an attacker from spoofing ARP messages with forged MAC-to-IP mappings.
- ✓
DAI can be configured to drop ARP packets with invalid MAC-to-IP address bindings.
Why this is correct
Cisco switches running DAI can enforce a validation of the sender MAC address (the hardware address in the ARP header) against the MAC address of the Ethernet frame, as well as the IP address, using the DHCP snooping table. If these checks fail, the ARP packet is not forwarded; it is dropped, and the switch can optionally rate-limit or log the violation. This configuration is typically done for each VLAN under the ip arp inspection validate command with options for src-mac, dst-mac, and ip.
- ✓
DAI is typically enabled on untrusted ports that face end hosts.
Why this is correct
DAI treats interfaces as either trusted or untrusted; trusted ports bypass all ARP inspection, while untrusted ports are subject to validation. Since end hosts are the source of potential ARP spoofing attacks, DAI is normally applied to the access ports where those hosts connect, while uplinks to routers, switches, or DHCP servers are configured as trusted. This design keeps the attack surface at the network edge while avoiding false positives on infrastructure links.
- ✗
DAI encrypts ARP replies to prevent eavesdropping.
Why it's wrong here
DAI does not apply any cryptographic protection—ARP packets remain plaintext and are not encrypted between hosts. The function of DAI is purely a security inspection feature that validates bindings; it doesn't encrypt traffic or alter the ARP packet format. Eavesdropping on ARP replies is not prevented by DAI, and any encryption of ARP would break protocol compatibility.
- ✗
DAI relies on the MAC address table to validate ARP requests.
Why it's wrong here
The MAC address table (CAM table) is used for Layer 2 forwarding decisions, recording which MAC addresses are reachable out of which switchports, but it does not contain IP-to-MAC bindings. DAI validates against the DHCP snooping binding database, not the MAC address table. The MAC table would be useless for this purpose because it doesn't track IP addresses or distinguish legitimate from spoofed IP-to-MAC pairs.
- ✗
DAI prevents rogue DHCP server attacks by inspecting DHCP offers.
Why it's wrong here
The mitigation of rogue DHCP servers is handled by DHCP snooping, which filters DHCP messages on untrusted ports and blocks DHCP offers arriving from access ports. DAI is a separate feature that works only with ARP packets; it never inspects DHCP offers. While DAI depends on the DHCP snooping database, it does not itself examine DHCP traffic.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.