100-150 Practice Question: Which Cisco feature is used to prevent Man-in-the-Middle attacks that rely on corrupting…
Which Cisco feature is used to prevent Man-in-the-Middle attacks that rely on corrupting the ARP cache of connected hosts?
⚠ Common exam trap
Candidates often confuse Dynamic ARP Inspection with DHCP Snooping. While DAI relies on the DHCP snooping database, it is specifically the feature that validates ARP packets to stop spoofing attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic ARP Inspection
ARP spoofing allows attackers to associate their MAC address with the IP address of a default gateway, effectively intercepting traffic. Dynamic ARP Inspection (DAI) uses the DHCP snooping database to validate ARP packets, ensuring that only legitimate mappings are allowed. This is a critical security feature in modern switches to prevent internal traffic interception, ensuring data privacy and integrity between hosts on the same Layer 2 domain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DHCP Snooping
Why it's wrong here
DHCP snooping blocks rogue DHCP servers and builds a binding table of each client's IP address, MAC address, VLAN and port. That table is what Dynamic ARP Inspection uses to check ARP packets, so snooping is a prerequisite, but by itself it never inspects ARP and cannot stop a host sending forged ARP replies. Enable both, with DAI providing the ARP protection.
- ✓
Dynamic ARP Inspection
Why this is correct
Dynamic ARP Inspection intercepts ARP packets on untrusted ports and checks each sender IP-to-MAC pairing against the DHCP snooping binding table, or static ARP ACLs for fixed addresses. Forged replies, such as an attacker claiming the gateway's address, are dropped and logged, so hosts' ARP caches cannot be poisoned. Uplinks are marked trusted, and untrusted ports are rate-limited to stop ARP floods.
- ✗
Port Security
Why it's wrong here
Port security limits which MAC addresses can send traffic on a port and how many. An attacker using a single, permitted MAC address can still send forged ARP replies claiming another device's IP address, because port security does not look at the IP-to-MAC claims inside ARP packets. Validating those claims is Dynamic ARP Inspection's job.
- ✗
IP Source Guard
Why it's wrong here
IP Source Guard uses the same binding table to filter IP traffic whose source IP or MAC address does not match what the port was assigned, preventing IP address spoofing. ARP packets are not IP packets, so it does not inspect them and cannot stop ARP cache poisoning. It complements Dynamic ARP Inspection, together with DHCP snooping, as part of first-hop security.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
This 100-150 question is part of Courseiva's 297-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar 100-150 questions
- A security administrator is reviewing logs and notices that an attacker on the internal network is sending forged ARP re…
- A network administrator needs to implement a VPN solution. Which TWO types of VPNs are commonly used in enterprise envir…
- A company requires employees to use both a password and a one-time code sent to their mobile device to access the corpor…
- An attacker on the same subnet sends frames with forged source MAC addresses to overwhelm a switch's MAC address table,…
- Which port security violation mode will drop packets from an unauthorized MAC address, increment the security violation…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 100-150 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 100-150 exam.