SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Users on one VLAN report that their traffic to the default gateway is intermittently slow and sometimes reaches the wrong device. A packet capture shows unsolicited ARP replies claiming to be the gateway. Which two actions are the best mitigations on managed switches? Select two.
⚠ Common exam trap
CompTIA often tests the dependency between DHCP snooping and Dynamic ARP Inspection, so candidates may incorrectly select DAI alone without realizing that DHCP snooping must be enabled first to populate the binding table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
enable DHCP snooping so trusted IP-to-MAC bindings can be validated
DHCP snooping creates a trusted database of IP-to-MAC bindings by monitoring DHCP messages. This database is then used by Dynamic ARP Inspection (DAI) to validate ARP packets, ensuring that only legitimate gateway addresses are accepted. Without DHCP snooping, DAI has no reliable source of truth to compare against, making it ineffective against ARP spoofing attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
enable DHCP snooping so trusted IP-to-MAC bindings can be validated
Why this is correct
DHCP snooping builds a trusted binding table that helps security controls distinguish valid host mappings from forged ones. On many managed switches, that table is used to support protections against spoofed layer 2 traffic. It is a standard companion control for preventing local network poisoning attacks.
- ✓
enable dynamic ARP inspection to block forged ARP replies
Why this is correct
Dynamic ARP inspection checks ARP traffic against trusted bindings and drops replies that do not match expected IP-to-MAC associations. That makes it one of the most effective mitigations for ARP spoofing or poisoning on managed switches. It directly addresses the bad ARP replies described in the capture.
- ✗
change the default gateway IP address on the subnet
Why it's wrong here
Changing the gateway address does not stop an attacker from forging ARP responses on the local segment. The poisoning issue is about false layer 2 mappings, not the specific gateway IP value. This would create administrative work without addressing the root cause.
- ✗
disable spanning tree protocol to reduce switching delays
Why it's wrong here
Spanning tree is unrelated to ARP poisoning and should not be disabled as a response to spoofed ARP traffic. Turning it off can actually create loops and instability on the network. This option addresses the wrong problem and could make the environment less reliable.
- ✗
replace private addressing with NAT on every endpoint
Why it's wrong here
Network address translation does not prevent layer 2 spoofing on a local subnet. The attack happens before traffic leaves the segment, so NAT is not the right mitigation. This would not stop forged ARP replies from redirecting traffic.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Social Engineering Attacks
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
Key term
Dynamic ARP Inspection
Dynamic ARP Inspection is a security feature that validates ARP packets on a network to prevent man-in-the-middle attacks by ensuring that only legitimate ARP messages are forwarded.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.