JNCIS-ENT Layer 2 Security Practice Question
An administrator configures Dynamic ARP Inspection (DAI) on an access switch. To ensure legitimate ARP packets from the default gateway (which uses a statically configured IP address on a core router) are not dropped, what must be configured?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the interface connected to the default gateway as a trusted interface for DAI.
The switch port connecting to the router or the router's IP binding must be explicitly trusted or added to a static ARP inspection log/ACL since routers do not participate in DHCP snooping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable DHCP snooping on the core router's interface.
Why it's wrong here
Routers running routing code do not run Junos DHCP snooping daemon.
- ✗
Configure a static DHCP binding for the gateway IP on the access switch.
Why it's wrong here
Static IP source entries or trusted interfaces are used; manual DHCP bindings are not required for router uplinks.
- ✗
Apply a Layer 2 firewall filter permitting ARP broadcasts from the gateway MAC.
Why it's wrong here
While a filter could work, the standard and correct design approach for DAI uplinks is trusting the interface.
- ✓
Configure the interface connected to the default gateway as a trusted interface for DAI.
Why this is correct
Since routers don't acquire IPs via DHCP snooping, the uplink port facing the gateway must be explicitly trusted for DAI to permit its ARP replies.
Visual reference
About these practice questions
This JNCIS-ENT question is part of Courseiva's 506-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Juniper Networks exam blueprint
This JNCIS-ENT practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JNCIS-ENT exam.