CEH Practice Question: Malware, Social Engineering and Network Attacks
Which THREE of the following are effective techniques to prevent ARP poisoning attacks? (Choose three.)
⚠ Common exam trap
Many candidates confuse DHCP snooping as a direct ARP poisoning prevention technique, when in fact it only provides the binding table that DAI uses, and without DAI enabled, DHCP snooping alone does not inspect or block malicious ARP packets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configuring port security on switches
Configuring port security on switches is effective against ARP poisoning because it limits the number of MAC addresses allowed on a port, preventing an attacker from flooding the network with spoofed MAC addresses. By restricting the port to a single or limited set of MAC addresses, it stops unauthorized devices from injecting fake ARP replies. This is a Layer 2 security control that directly mitigates the ability to perform ARP cache poisoning at the access edge.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enabling DHCP snooping
Why it's wrong here
Enabling DHCP snooping primarily secures the DHCP infrastructure by preventing rogue DHCP servers and ensuring clients receive IP addresses from legitimate sources. While it builds a crucial binding table of MAC-IP-port-VLAN mappings, it does not directly validate or prevent malicious ARP requests or replies itself. Its role is foundational for Dynamic ARP Inspection (DAI), but not a direct ARP poisoning prevention technique on its own.
- ✓
Configuring port security on switches
Why this is correct
Configuring port security on switches is an effective technique because it limits the number of MAC addresses that can be learned on a specific switch port. By restricting a port to a single, legitimate MAC address or a small, defined set, it prevents an attacker from introducing a new, spoofed MAC address to impersonate another device or the gateway, thereby mitigating ARP poisoning attempts that rely on MAC address changes.
- ✓
Using static ARP entries
Why this is correct
Using static ARP entries involves manually configuring the MAC address for a specific IP address within a device's ARP cache. This hard-coded, immutable mapping ensures that the device will always use the predefined MAC address for that IP, effectively ignoring any unsolicited or malicious ARP replies that attempt to change the mapping. This method is highly effective for critical devices like gateways or servers, preventing their ARP entries from being poisoned.
- ✗
Disabling STP on all ports
Why it's wrong here
Disabling Spanning Tree Protocol (STP) on all ports is entirely ineffective against ARP poisoning and is, in fact, detrimental to network stability. STP's purpose is to prevent network loops by blocking redundant paths, not to validate ARP packets or secure MAC-IP bindings. Removing STP would introduce the risk of broadcast storms and MAC address table instability, which could exacerbate network issues rather than prevent ARP-related attacks.
- ✓
Implementing Dynamic ARP Inspection (DAI)
Why this is correct
Implementing Dynamic ARP Inspection (DAI) is a robust security feature that actively intercepts and validates ARP packets on a switch. It compares the source IP and MAC addresses in incoming ARP requests and replies against a trusted database, typically populated by DHCP snooping. If an ARP packet's information does not match a valid binding, DAI drops the packet, effectively preventing attackers from injecting false MAC-IP mappings into the network.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.