hardMultiple Select
ISC2 CC Practice Question: A security team is investigating a potential ARP…
A security team is investigating a potential ARP spoofing attack on the local network. Which two measures can effectively detect or prevent such attacks? (Choose two.)
⚠ Common exam trap
ISC2 often tests the distinction between Layer 2 security features (like DAI and DHCP snooping) and Layer 3 or other mitigation techniques (like ICMP redirects or BPDU guard), leading candidates to confuse unrelated security controls with ARP-specific defenses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable DHCP snooping with Dynamic ARP Inspection.
Option B is correct because Dynamic ARP Inspection (DAI), working together with DHCP snooping, validates ARP packets against the trusted DHCP snooping binding table and drops ARP packets with spoofed IP-to-MAC mappings, directly detecting and preventing ARP spoofing on the local network. Option E is correct because configuring static ARP entries on critical servers hard-codes the legitimate IP-to-MAC mappings, so the servers ignore forged ARP replies and cannot be poisoned by an attacker on the same segment. Option A does not belong because disabling ICMP redirects only prevents hosts from accepting forged redirect messages for routing manipulation, not ARP cache poisoning. Option C does not belong because MAC address filtering on switches only restricts which MAC addresses may appear on a port and does not validate ARP payloads, so an attacker can still spoof ARP for an allowed MAC. Option D does not belong because STP BPDU guard protects against rogue switches sending spanning-tree BPDUs and has no role in detecting or preventing ARP spoofing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable ICMP redirects on hosts.
Why it's wrong here
ICMP redirects concern layer-3 routing messages, not ARP, so disabling them leaves ARP cache poisoning untouched. It is tempting because ICMP redirect manipulation is a genuine attack vector, and this hardening is correct when hosts must ignore forged redirects to prevent traffic rerouting.
- ✓
Enable DHCP snooping with Dynamic ARP Inspection.
Why this is correct
Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table, dropping replies that map an IP to the wrong MAC. This detects and blocks ARP spoofing, satisfying the requirement to identify forged ARP traffic on the local network.
- ✗
Use MAC address filtering on switches.
Why it's wrong here
MAC address filtering restricts which source MACs may use a switch port, but ARP spoofing uses the attacker's own legitimate MAC with forged IP-to-MAC mappings, so filtering does not detect it. It is tempting as a Layer 2 access control, and would be correct for limiting unknown devices on a port.
- ✗
Enable STP BPDU guard.
Why it's wrong here
BPDU guard disables a port receiving spanning-tree BPDUs, defending against rogue switches and topology loops, not ARP poisoning. It is tempting because it is a Layer 2 port-security measure, and would be correct when implementing PortFast edge ports that must never participate in STP.
- ✓
Configure static ARP entries on critical servers.
Why this is correct
ARP spoofing works by flooding a segment with forged replies that overwrite legitimate IP-to-MAC bindings in host caches. Hard-coding static ARP entries for gateways and critical servers on those hosts removes the cache as an attack surface, so forged replies cannot displace the trusted mapping and traffic continues to the genuine device.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
Key term
Dynamic ARP Inspection
Dynamic ARP Inspection is a security feature that validates ARP packets on a network to prevent man-in-the-middle attacks by ensuring that only legitimate ARP messages are forwarded.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.