Quick Answer

The correct order ends with valid ARP packets being forwarded and invalid ARP packets being dropped. This sequence is correct because DHCP snooping must first build a reliable binding table by monitoring DHCP messages exchanged between clients and servers, validating server messages only on trusted ports to block rogue DHCP offers. Once that binding table is established, Dynamic ARP Inspection (DAI) can then intercept every ARP packet on untrusted ports and cross-reference the sender’s MAC and IP address against the table. If the ARP packet matches a valid binding, it is forwarded; if it does not match or is inconsistent, it is dropped. On the ENCOR 350-401 exam, this drag-and-drop task tests your understanding of the causal dependency between DHCP snooping and DAI—a common trap is placing DAI steps before the binding table is built. Remember the memory tip: “Bind first, then inspect—match forwards, mismatch rejects.”