Question 199 of 1,013
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
Packet Capture Summary Host 10.20.30.44 sends repeated ARP replies: "10.20.30.1 is at 00:11:22:33:44:55" "10.20.30.1 is at 00:11:22:33:44:55" Switch logs: DHCP snooping: disabled ARP inspection: disabled Users report intermittent gateway connectivity and traffic sent to the wrong MAC address.
Based on the exhibit, which control should be enabled to mitigate this issue?
⚠ Common exam trap
Test-takers frequently confuse DNSSEC (which secures DNS) with ARP security mechanisms, or they assume port forwarding or load balancing can mitigate Layer 2 spoofing attacks, when in fact only DAI with DHCP snooping directly validates ARP integrity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings.
Dynamic ARP inspection (DAI) with DHCP snooping validates ARP packets against a trusted binding database, preventing man-in-the-middle attacks where an attacker spoofs the MAC address of a legitimate host (e.g., the default gateway) to intercept traffic. The exhibit likely shows a scenario of ARP spoofing or cache poisoning, which DAI directly mitigates by dropping invalid ARP replies. DHCP snooping builds the trusted binding table by recording which IP address is assigned to which MAC address on which port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNSSEC, because it validates DNS records and would stop local address-to-MAC spoofing.
Why it's wrong here
DNSSEC protects DNS data integrity, but this incident is about forged ARP replies on a local subnet. ARP operates below DNS and is used to resolve IP addresses to MAC addresses. DNSSEC would not stop the bad ARP mappings shown in the capture.
- ✗
Port forwarding, because it can direct traffic to the correct internal host more reliably.
Why it's wrong here
Port forwarding is a routing or NAT convenience mechanism, not a protection against forged Layer 2 address resolution. The problem here is that clients are learning a fake MAC address for the gateway. Forwarding does not validate ARP or stop spoofed replies.
- ✗
Load balancing, because it would distribute traffic and reduce the impact of connectivity issues.
Why it's wrong here
Load balancing improves availability for services, but it does not detect or prevent ARP poisoning on a local broadcast domain. The exhibit shows hosts being tricked into using the wrong MAC address, which must be addressed with a Layer 2 security control.
- ✓
Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings.
Why this is correct
Dynamic ARP inspection is designed to block forged ARP messages by checking them against trusted information, usually built from DHCP snooping bindings. Since the switch logs show both DHCP snooping and ARP inspection disabled, enabling these controls is the most appropriate mitigation for the poisoning behavior described.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.