DHCP Snooping increases ARP inspection efficiency and prevents DHCP-related spoofing on a LAN.

DHCP Snooping increases ARP inspection efficiency and prevents DHCP-related spoofing on a LAN.

• A. Dynamic ARP Inspection
• B. Double Tagging
• C. DHCP Snooping
• D. 6to4

Answer: (C)

DHCP snooping is a security feature on switches that creates a trusted database of DHCP bindings (which IP address is assigned to which MAC on which port) by listening to legitimate DHCP conversations. With this binding information, the switch can enforce that only authorized DHCP servers can hand out IP addresses and it can mark ports as trusted or untrusted. When ARP traffic flows, Dynamic ARP Inspection can verify ARP requests and replies against the DHCP binding database, quickly confirming that the IP–MAC pair matches a known, legitimate client. This makes ARP inspection more efficient and accurate because the switch has a ready, authoritative reference rather than having to guess or learn bindings on the fly. It also blocks rogue DHCP servers from distributing addresses, preventing DHCP-related spoofing. The other options don’t fit the described role: Dynamic ARP Inspection is the ARP verification mechanism itself and benefits from DHCP snooping, but it’s not the feature described; Double Tagging is a VLAN-tagging technique with no relation to DHCP or ARP security; 6to4 is an IPv6 transition mechanism and not related to DHCP or ARP security.

DHCP snooping is a security feature on switches that creates a trusted database of DHCP bindings (which IP address is assigned to which MAC on which port) by listening to legitimate DHCP conversations. With this binding information, the switch can enforce that only authorized DHCP servers can hand out IP addresses and it can mark ports as trusted or untrusted. When ARP traffic flows, Dynamic ARP Inspection can verify ARP requests and replies against the DHCP binding database, quickly confirming that the IP–MAC pair matches a known, legitimate client. This makes ARP inspection more efficient and accurate because the switch has a ready, authoritative reference rather than having to guess or learn bindings on the fly. It also blocks rogue DHCP servers from distributing addresses, preventing DHCP-related spoofing.

The other options don’t fit the described role: Dynamic ARP Inspection is the ARP verification mechanism itself and benefits from DHCP snooping, but it’s not the feature described; Double Tagging is a VLAN-tagging technique with no relation to DHCP or ARP security; 6to4 is an IPv6 transition mechanism and not related to DHCP or ARP security.