Which statement best describes ARP spoofing and a common mitigation?

• A. DHCP snooping and dynamic ARP inspection
• B. Use static ARP entries only
• C. Disable ARP everywhere on the network
• D. Block ARP with a firewall appliance

Answer: (A)

ARP spoofing works by an attacker sending forged ARP replies to associate their MAC address with the IP address of another device (often the gateway), so traffic is misrouted through the attacker’s device and can be intercepted or altered.

A common and effective mitigation is to enable DHCP snooping together with dynamic ARP inspection on switches. DHCP snooping creates a trusted binding database of IP-to-MAC mappings from the DHCP server. Dynamic ARP inspection then uses that database to verify ARP packets: an ARP reply is allowed only if its claimed IP-to-MAC mapping matches an entry in the DHCP snooping table and the packet comes from a legitimate port. If a rogue device tries to spoof an ARP reply, the switch blocks the packet because the mapping doesn’t align with the trusted bindings.

Static ARP entries might help in small networks but aren’t scalable or robust for dynamic environments. Disabling ARP everywhere would break normal network operation, and blocking ARP with a firewall isn’t practical because ARP is a layer-2 protocol used inside broadcast domains. The DHCP snooping and dynamic ARP inspection combo provides automated, scalable protection without breaking standard networking.