You are concerned about spoofed MAC addresses on your LAN. Which two Layer 2 security features should you enable to minimize this concern? (Choose…

To mitigate the threat of spoofed MAC addresses—specifically through ARP spoofing or poisoning attacks on a LAN—Dynamic ARP Inspection (DAI) and DHCP snooping must be implemented together. DAI intercepts and examines all ARP packets on untrusted ports, validating the sender's IP-to-MAC address binding. It actively drops invalid ARP packets that attempt to map a malicious MAC address to a legitimate IP address, thereby neutralizing the spoofing attempt. Because DAI relies on a dynamically built, trusted binding database to verify these addresses, DHCP snooping must also be enabled. DHCP snooping monitors DHCP messages to construct and maintain this authoritative IP-to-MAC binding database, making it a mandatory prerequisite for DAI to function effectively on the switch.

B. IP source guard: While it uses the DHCP snooping database to prevent IP spoofing by validating source IP/MAC bindings on data packets, it does not inspect or prevent ARP-based MAC spoofing.

D. static ARP: Static ARP entries can prevent spoofing for specific, manually configured hosts, but it is an administrative mechanism, not a scalable Layer 2 security feature for an entire LAN.

1. Juniper Networks. (2023). Junos OS Layer 2 Networking Configuration Guide. Document ID: J-L2-Sec-01. Section: "Understanding Dynamic ARP Inspection," Paragraphs 1-3. (Details DAI's role in preventing ARP/MAC spoofing and its strict dependency on the DHCP snooping database).

2. Juniper Networks. (2023). Junos OS Layer 2 Networking Configuration Guide. Document ID: J-L2-Sec-01. Section: "Understanding DHCP Snooping," Paragraph 2. (Explains the creation of the DHCP snooping binding database used by Layer 2 security features like DAI).