ISC2 CC Network Security Practice Question
A network engineer wants to mitigate ARP spoofing attacks. Which of the following is the most effective technique?
⚠ Common exam trap
The trap is confusing ARP spoofing mitigation with general Layer 2 security features like STP or with host-based static entries; candidates must recognize that DAI is the specific switch-based defense against ARP spoofing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement Dynamic ARP Inspection
Dynamic ARP Inspection (DAI) is a security feature on switches that validates ARP packets in a network. It intercepts ARP requests and replies on untrusted ports, compares them against a trusted binding table (often built via DHCP snooping), and drops invalid or malicious ARP packets. This directly prevents ARP spoofing by ensuring only legitimate ARP mappings are allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement Dynamic ARP Inspection
Why this is correct
Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table, dropping packets with spoofed IP-to-MAC mappings. This directly neutralises ARP spoofing on the switched segment, unlike encryption or static entries, satisfying the stem's mitigation requirement.
- ✗
Enable STP
Why it's wrong here
STP prevents loops, not ARP spoofing.
- ✗
Use static ARP entries
Why it's wrong here
Static ARP entries only protect the specific hosts where they are manually configured, so they cannot scale across a large network and leave every unconfigured device still vulnerable to spoofing. They are tempting because they genuinely prevent cache poisoning on a small, fixed set of critical hosts such as servers or gateways.
- ✗
Disable ICMP
Why it's wrong here
Disabling ICMP removes ping and traceroute diagnostics but does nothing to ARP, which is a separate Layer 2 protocol; spoofed ARP replies still poison caches. It is tempting because ICMP is often abused for reconnaissance and tunnelling, so blocking it hardens against those unrelated threats.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
DHCP snooping
DHCP snooping is a network security feature that filters untrusted DHCP messages to prevent rogue DHCP servers from giving out false IP addresses.
Key term
Dynamic ARP Inspection
Dynamic ARP Inspection is a security feature that validates ARP packets on a network to prevent man-in-the-middle attacks by ensuring that only legitimate ARP messages are forwarded.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.