The correct choice is Dynamic ARP inspection with DHCP snooping, because this combination validates ARP replies against a trusted binding database, directly preventing ARP spoofing and man-in-the-middle attacks where an attacker impersonates a legitimate host like the default gateway. DHCP snooping builds that trusted table by recording which IP address is assigned to which MAC address on which switch port, and DAI then drops any ARP packet that does not match these bindings. On the Security+ SY0-701 exam, this scenario typically appears as a network security question testing your ability to identify the proper mitigation for ARP cache poisoning, with a common trap being to confuse DAI with port security or MAC filtering. Remember the mnemonic: DAI needs DHCP snooping to know who is trusted, just like a bouncer needs a guest list to spot fakes.
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
This SY0-701 practice question tests your understanding of threats, vulnerabilities, and mitigations. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Packet Capture Summary
Host 10.20.30.44 sends repeated ARP replies:
"10.20.30.1 is at 00:11:22:33:44:55"
"10.20.30.1 is at 00:11:22:33:44:55"
Switch logs:
DHCP snooping: disabled
ARP inspection: disabled
Users report intermittent gateway connectivity and traffic sent to the wrong MAC address.
Based on the exhibit, which control should be enabled to mitigate this issue?
Packet Capture Summary
Host 10.20.30.44 sends repeated ARP replies:
"10.20.30.1 is at 00:11:22:33:44:55"
"10.20.30.1 is at 00:11:22:33:44:55"
Switch logs:
DHCP snooping: disabled
ARP inspection: disabled
Users report intermittent gateway connectivity and traffic sent to the wrong MAC address.
A
DNSSEC, because it validates DNS records and would stop local address-to-MAC spoofing.
Why wrong: DNSSEC protects DNS data integrity, but this incident is about forged ARP replies on a local subnet. ARP operates below DNS and is used to resolve IP addresses to MAC addresses. DNSSEC would not stop the bad ARP mappings shown in the capture.
B
Port forwarding, because it can direct traffic to the correct internal host more reliably.
Why wrong: Port forwarding is a routing or NAT convenience mechanism, not a protection against forged Layer 2 address resolution. The problem here is that clients are learning a fake MAC address for the gateway. Forwarding does not validate ARP or stop spoofed replies.
C
Load balancing, because it would distribute traffic and reduce the impact of connectivity issues.
Why wrong: Load balancing improves availability for services, but it does not detect or prevent ARP poisoning on a local broadcast domain. The exhibit shows hosts being tricked into using the wrong MAC address, which must be addressed with a Layer 2 security control.
D
Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings.
Dynamic ARP inspection is designed to block forged ARP messages by checking them against trusted information, usually built from DHCP snooping bindings. Since the switch logs show both DHCP snooping and ARP inspection disabled, enabling these controls is the most appropriate mitigation for the poisoning behavior described.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings.
Dynamic ARP inspection (DAI) with DHCP snooping validates ARP packets against a trusted binding database, preventing man-in-the-middle attacks where an attacker spoofs the MAC address of a legitimate host (e.g., the default gateway) to intercept traffic. The exhibit likely shows a scenario of ARP spoofing or cache poisoning, which DAI directly mitigates by dropping invalid ARP replies. DHCP snooping builds the trusted binding table by recording which IP address is assigned to which MAC address on which port.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
DNSSEC, because it validates DNS records and would stop local address-to-MAC spoofing.
Why it's wrong here
DNSSEC protects DNS data integrity, but this incident is about forged ARP replies on a local subnet. ARP operates below DNS and is used to resolve IP addresses to MAC addresses. DNSSEC would not stop the bad ARP mappings shown in the capture.
✗
Port forwarding, because it can direct traffic to the correct internal host more reliably.
Why it's wrong here
Port forwarding is a routing or NAT convenience mechanism, not a protection against forged Layer 2 address resolution. The problem here is that clients are learning a fake MAC address for the gateway. Forwarding does not validate ARP or stop spoofed replies.
✗
Load balancing, because it would distribute traffic and reduce the impact of connectivity issues.
Why it's wrong here
Load balancing improves availability for services, but it does not detect or prevent ARP poisoning on a local broadcast domain. The exhibit shows hosts being tricked into using the wrong MAC address, which must be addressed with a Layer 2 security control.
✓
Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings.
Why this is correct
Dynamic ARP inspection is designed to block forged ARP messages by checking them against trusted information, usually built from DHCP snooping bindings. Since the switch logs show both DHCP snooping and ARP inspection disabled, enabling these controls is the most appropriate mitigation for the poisoning behavior described.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse DNSSEC (which secures DNS) with ARP security mechanisms, or they assume port forwarding or load balancing can mitigate Layer 2 spoofing attacks, when in fact only DAI with DHCP snooping directly validates ARP integrity.
Trap categories for this question
Command / output trap
DNSSEC protects DNS data integrity, but this incident is about forged ARP replies on a local subnet. ARP operates below DNS and is used to resolve IP addresses to MAC addresses. DNSSEC would not stop the bad ARP mappings shown in the capture.
Detailed technical explanation
How to think about this question
DAI intercepts all ARP requests and replies on untrusted ports and verifies that each packet has a valid IP-to-MAC binding using the DHCP snooping database; if no binding exists, the packet is dropped. A subtle behavior is that DAI also validates that the source MAC address in the Ethernet header matches the sender MAC address in the ARP body, preventing MAC spoofing even if the IP binding is correct. In a real-world scenario, an attacker on a switched network could send a gratuitous ARP claiming the gateway's IP with their own MAC; DAI would drop this because the port's binding table shows a different MAC for that IP.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
Threats, Vulnerabilities, and Mitigations — This question tests Threats, Vulnerabilities, and Mitigations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings. — Dynamic ARP inspection (DAI) with DHCP snooping validates ARP packets against a trusted binding database, preventing man-in-the-middle attacks where an attacker spoofs the MAC address of a legitimate host (e.g., the default gateway) to intercept traffic. The exhibit likely shows a scenario of ARP spoofing or cache poisoning, which DAI directly mitigates by dropping invalid ARP replies. DHCP snooping builds the trusted binding table by recording which IP address is assigned to which MAC address on which port.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.