Courseiva
Threats, Vulnerabilities, and MitigationsmediumMultiple SelectObjective-mapped

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Users on one VLAN report that their traffic to the default gateway is intermittently slow and sometimes reaches the wrong device. A packet capture shows unsolicited ARP replies claiming to be the gateway. Which two actions are the best mitigations on managed switches? Select two.

⚠ Common exam trap

CompTIA often tests the dependency between DHCP snooping and Dynamic ARP Inspection, so candidates may incorrectly select DAI alone without realizing that DHCP snooping must be enabled first to populate the binding table.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

enable DHCP snooping so trusted IP-to-MAC bindings can be validated

DHCP snooping creates a trusted database of IP-to-MAC bindings by monitoring DHCP messages. This database is then used by Dynamic ARP Inspection (DAI) to validate ARP packets, ensuring that only legitimate gateway addresses are accepted. Without DHCP snooping, DAI has no reliable source of truth to compare against, making it ineffective against ARP spoofing attacks.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • enable DHCP snooping so trusted IP-to-MAC bindings can be validated

    Why this is correct

    DHCP snooping builds a trusted binding table that helps security controls distinguish valid host mappings from forged ones. On many managed switches, that table is used to support protections against spoofed layer 2 traffic. It is a standard companion control for preventing local network poisoning attacks.

  • enable dynamic ARP inspection to block forged ARP replies

    Why this is correct

    Dynamic ARP inspection checks ARP traffic against trusted bindings and drops replies that do not match expected IP-to-MAC associations. That makes it one of the most effective mitigations for ARP spoofing or poisoning on managed switches. It directly addresses the bad ARP replies described in the capture.

  • change the default gateway IP address on the subnet

    Why it's wrong here

    Changing the gateway address does not stop an attacker from forging ARP responses on the local segment. The poisoning issue is about false layer 2 mappings, not the specific gateway IP value. This would create administrative work without addressing the root cause.

  • disable spanning tree protocol to reduce switching delays

    Why it's wrong here

    Spanning tree is unrelated to ARP poisoning and should not be disabled as a response to spoofed ARP traffic. Turning it off can actually create loops and instability on the network. This option addresses the wrong problem and could make the environment less reliable.

  • replace private addressing with NAT on every endpoint

    Why it's wrong here

    Network address translation does not prevent layer 2 spoofing on a local subnet. The attack happens before traffic leaves the segment, so NAT is not the right mitigation. This would not stop forged ARP replies from redirecting traffic.

Visual reference

Client DHCP Server 1 Discover (broadcast) 2 Offer (IP: 192.168.1.10) 3 Request (I accept) 4 Acknowledge (lease confirmed) DORA — the four-step DHCP lease process

Quick reference

Access Control Model Comparison

ModelAcronymWho Controls Access?Best For
Discretionary Access ControlDACResource ownerSmall teams, file shares
Mandatory Access ControlMACSystem / security labelsClassified govt / military
Role-Based Access ControlRBACAdministrator (via roles)Enterprise environments
Attribute-Based Access ControlABACPolicy engine (user + resource attributes)Fine-grained, dynamic policies
Rule-Based Access ControlRuBACSystem rules / ACLsFirewall rules, network ACLs

About these practice questions

One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.