Quick Answer

The correct match for VLAN hopping is to disable Dynamic Trunking Protocol, while MAC flooding is mitigated by port security, DHCP starvation by DHCP snooping, ARP spoofing by Dynamic ARP Inspection, and STP manipulation by BPDU guard. These pairings work because each attack exploits a specific Layer 2 weakness: VLAN hopping uses DTP negotiation to gain unauthorized trunk access, so disabling DTP on access ports eliminates the negotiation; MAC flooding overflows the CAM table, which port security prevents by limiting MAC addresses per port; DHCP starvation exhausts the DHCP pool, which DHCP snooping thwarts by validating messages; ARP spoofing poisons the ARP cache, which DAI intercepts using the DHCP snooping binding table; and STP manipulation sends rogue BPDUs, which BPDU guard blocks by error-disabling the port. On the ENCOR 350-401 exam, this drag-and-drop task tests your ability to recall these specific mitigations without mixing them up—a common trap is confusing DAI with DHCP snooping or assuming STP attacks are stopped by root guard instead of BPDU guard. For a quick memory aid, think of the acronym “PADS-B”: Port security, ARP inspection, DHCP snooping, STP guard (BPDU guard), and VLAN hopping (disable DTP).