N10-009 Network Security Practice Question
Which security feature on a switch can prevent an attacker from sending forged ARP messages to redirect traffic?
⚠ Common exam trap
The N10-009 exam often tests the distinction between DHCP snooping (which builds the trust database) and Dynamic ARP Inspection (which uses that database to validate ARP traffic), leading candidates to mistakenly choose DHCP snooping as the direct defense against ARP spoofing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic ARP Inspection
Dynamic ARP Inspection (DAI) is the correct answer because it validates ARP packets against a trusted database (the DHCP snooping binding table) to ensure that the MAC-to-IP address mapping is legitimate. By intercepting and verifying all ARP requests and replies on untrusted ports, DAI prevents an attacker from sending forged ARP messages to redirect traffic (ARP spoofing).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Port security
Why it's wrong here
Port security limits the number of MAC addresses per port and can block unauthorised devices, but it does not inspect or validate the IP-to-MAC bindings in ARP packets, so forged ARP messages pass through unhindered. It is tempting because it controls access at Layer 2, and would be the correct choice to prevent MAC flooding attacks or unauthorised device connections on a port.
When this WOULD be correct
Port security would be correct for a question like: 'Which feature prevents MAC flooding attacks by limiting the number of MAC addresses learned on a switch port?'
- ✗
DHCP snooping
Why it's wrong here
DHCP snooping is a Layer 2 security feature that filters untrusted DHCP messages and builds a binding table of legitimate IP-to-MAC-to-port mappings. Its primary role is to prevent rogue DHCP servers and enforce DHCP lease integrity, not to directly inspect or validate ARP packets. While DHCP snooping is crucial for populating the binding table that Dynamic ARP Inspection (DAI) relies upon, it does not, by itself, prevent ARP spoofing.
When this WOULD be correct
A question asks: 'Which feature prevents rogue DHCP servers from assigning false IP addresses?' DHCP snooping would be the correct answer because it filters DHCP server messages on untrusted ports.
- ✓
Dynamic ARP Inspection
Why this is correct
Dynamic ARP Inspection (DAI) actively validates ARP packets by comparing the source IP address, MAC address, VLAN, and port information against a trusted binding table, typically built by DHCP snooping. This process identifies and drops invalid or forged ARP requests and replies, effectively preventing ARP spoofing attacks. By ensuring the integrity of IP-to-MAC address mappings, DAI mitigates man-in-the-middle attacks that rely on manipulating the ARP cache.
- ✗
VLAN segmentation
Why it's wrong here
VLAN segmentation isolates network traffic into separate broadcast domains, limiting the scope of broadcast storms and enhancing network organization. However, it does not prevent ARP spoofing because an attacker operating within the same VLAN can still send forged ARP messages to other devices in that specific broadcast domain. While VLANs improve security by containing traffic, they do not validate the authenticity of Layer 2 address resolution protocols.
When this WOULD be correct
A question asking 'Which feature can be used to isolate broadcast domains and limit the scope of ARP spoofing attacks?' would make VLAN segmentation correct, as it reduces the attack surface by separating traffic.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Dynamic ARP InspectionCorrect answer▾
Why this is correct
Dynamic ARP Inspection (DAI) actively validates ARP packets by comparing the source IP address, MAC address, VLAN, and port information against a trusted binding table, typically built by DHCP snooping. This process identifies and drops invalid or forged ARP requests and replies, effectively preventing ARP spoofing attacks. By ensuring the integrity of IP-to-MAC address mappings, DAI mitigates man-in-the-middle attacks that rely on manipulating the ARP cache.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security limits MAC addresses on a port but does not inspect or validate ARP packets, so it cannot prevent forged ARP messages used in ARP spoofing attacks.
★ When this WOULD be the correct answer
Port security would be correct for a question like: 'Which feature prevents MAC flooding attacks by limiting the number of MAC addresses learned on a switch port?'
Why candidates choose this
Candidates may confuse port security with ARP inspection because both involve MAC addresses, but port security does not validate ARP packet contents.
✗DHCP snoopingWrong answer — click to see why▾
Why this is wrong here
DHCP snooping validates DHCP messages and builds a binding database, but it does not inspect or filter ARP messages. It cannot prevent forged ARP attacks directly.
★ When this WOULD be the correct answer
A question asks: 'Which feature prevents rogue DHCP servers from assigning false IP addresses?' DHCP snooping would be the correct answer because it filters DHCP server messages on untrusted ports.
Why candidates choose this
Candidates may confuse DHCP snooping with Dynamic ARP Inspection (DAI) because DAI often relies on the DHCP snooping binding table. They might think DHCP snooping alone can stop ARP spoofing.
✗VLAN segmentationWrong answer — click to see why▾
Why this is wrong here
VLAN segmentation isolates network traffic into separate broadcast domains but does not inspect or validate ARP messages, so it cannot prevent forged ARP attacks that redirect traffic within the same VLAN.
★ When this WOULD be the correct answer
A question asking 'Which feature can be used to isolate broadcast domains and limit the scope of ARP spoofing attacks?' would make VLAN segmentation correct, as it reduces the attack surface by separating traffic.
Why candidates choose this
Candidates may think VLAN segmentation prevents ARP spoofing because it logically separates traffic, but it lacks the packet inspection needed to detect and block forged ARP replies.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Wireless Security Protocols
Key term
Dynamic ARP Inspection
Dynamic ARP Inspection is a security feature that validates ARP packets on a network to prevent man-in-the-middle attacks by ensuring that only legitimate ARP messages are forwarded.
Key term
DHCP snooping
DHCP snooping is a network security feature that filters untrusted DHCP messages to prevent rogue DHCP servers from giving out false IP addresses.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.