A school district needs to block ARP poisoning between kiosk VLAN hosts. Which feature validates ARP against the DHCP snooping database?
Select an answer to reveal the explanation.
Short Explanation
DAI is the ARP fact-checker—it compares who claims an IP in an ARP message against DHCP snooping’s binding book. Poisoned replies that don’t match get dropped.
Full Explanation
Dynamic ARP Inspection intercepts ARP and validates sender IP/MAC pairs against the DHCP snooping database (plus any static ARP ACLs), mitigating ARP spoofing on a school-district kiosk VLAN. DAI is the feature that blocks ARP poisoning between kiosk hosts by permitting ARP only when bindings match.
CoPP class-maps matching ARP on the supervisor rate-limit control-plane ARP; they do not provide per-VLAN binding validation for host ARP poisoning. VTP pruning of the kiosk VLAN on trunks reduces flooded VLAN scope but does not validate ARP bindings. uRPF loose mode on the kiosk SVI alone without DAI does not implement ARP-binding checks on the L2 segment.
Exam caveat: ARP poisoning on L2 → DAI + snooping bindings; CoPP and VTP are different tools.
Operational check: enable DAI on the kiosk VLAN with snooping bindings present, test forged ARP replies, confirm drops/syslogs, and keep trusted uplinks correctly marked. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services. Re-validate after the next platform or policy change. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.