Which three conditions allow an ARP request or response to pass a Dynamic ARP Inspection (DAI) check? (Choose three.)

Dynamic ARP Inspection (DAI) validates ARP packets to prevent ARP spoofing attacks. An ARP packet is permitted to pass a DAI check under three primary conditions. First, if the packet arrives on an untrusted port, its IP-to-MAC address binding is checked against the DHCP snooping database; a match allows the packet to pass. Second, for devices with static IP addresses, a manually configured static ARP entry (or ARP ACL) allows the corresponding ARP packets to be validated. Third, any ARP packet received on a port configured as "trusted" (e.g., an uplink to another switch or router) is permitted to pass without any inspection.

C. Client authenticated using MAC authentication.

This is incorrect. MAC authentication validates a device's identity at Layer 2 but does not create the IP-to-MAC binding that DAI uses for its validation process.

D. Client authenticated using RADIUS on an 802.1X enabled port.

This is incorrect. Similar to MAC authentication, 802.1X authenticates a user or device but does not directly populate the database that DAI relies on for ARP validation.

F. There is a static reservation for the IP/MAC pair in the DHCP pool.

This is incorrect. While a DHCP reservation leads to a consistent entry in the DHCP snooping database (Option A), DAI checks the switch's database, not the DHCP server's configuration.

1. RUCKUS FastIron Security Configuration Guide, 08.0.95, Page 273, "DAI operation": "For incoming ARP packets on untrusted ports, DAI intercepts the packets and validates them against the DHCP snooping binding database. If an ARP packet is valid, it is forwarded. If it is invalid, it is dropped." (Supports Answer A).

2. RUCKUS FastIron Security Configuration Guide, 08.0.95, Page 273, "DAI operation": "ARP packets received on trusted ports are not inspected." (Supports Answer E).

3. RUCKUS FastIron Security Configuration Guide, 08.0.95, Page 277, "Configuring static ARP entries for DAI": "In addition to using the DHCP snooping binding database, you can configure static ARP entries to be used by DAI. This feature is useful for network devices that require static IP addresses, such as servers and printers." (Supports Answer B).