SSCP Network and Communications Security Practice Question
A security analyst is reviewing network traffic and notices that an attacker is sending forged ARP replies to a host, attempting to associate the attacker's MAC address with the IP address of the default gateway. Which security feature should be implemented on the switch to prevent this attack?
⚠ Common exam trap
Test-takers frequently confuse DHCP snooping with Dynamic ARP Inspection; DHCP snooping builds the binding table but does not filter ARP packets, while DAI actively validates and drops malicious ARP replies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic ARP Inspection (DAI)
Dynamic ARP Inspection (DAI) is the switch feature designed to prevent ARP spoofing by validating ARP packets against a trusted binding table. It drops ARP packets that contain invalid IP-to-MAC mappings, thereby blocking the attacker's attempt to associate their MAC with the gateway's IP. Other features like port security, DHCP snooping, or 802.1X do not provide this specific ARP validation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Port security
Why it's wrong here
Port security restricts which MAC addresses can connect to a switch port, preventing MAC flooding and unauthorized devices. However, it does not validate the mapping between IP and MAC addresses in ARP replies. An attacker can still send forged ARP replies from an allowed MAC address. Therefore, port security alone does not prevent ARP spoofing, though it can be part of a layered defense.
- ✗
DHCP snooping
Why it's wrong here
DHCP snooping is a security feature that filters untrusted DHCP messages and builds a binding table of IP-to-MAC mappings. While it provides the database used by DAI, it does not itself inspect or block ARP packets. Without DAI, DHCP snooping alone cannot prevent ARP spoofing. It is a prerequisite for DAI but not the direct solution.
- ✓
Dynamic ARP Inspection (DAI)
Why this is correct
Dynamic ARP Inspection (DAI) validates ARP packets on untrusted ports by comparing the IP-to-MAC binding against a trusted database, such as the DHCP snooping binding table. It drops ARP packets with invalid bindings, preventing ARP spoofing attacks. This directly addresses the scenario where an attacker is sending forged ARP replies to impersonate the default gateway.
- ✗
802.1X authentication
Why it's wrong here
802.1X is a port-based network access control that authenticates devices before allowing them onto the network. It prevents unauthorized devices from connecting but does not inspect ARP traffic after authentication. An authenticated attacker could still perform ARP spoofing. Therefore, 802.1X does not directly prevent the described attack, though it is a valuable access control measure.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.