Cisco Certified Internetwork Expert (CCIE) Practice Test

Which two features help mitigate man-in-the-middle attacks?

1. ARP spoofing

2. ARP sniffing on specific ports

3. DHCP snooping

4. Dynamic ARP inspection

The correct answer is: DHCP snooping

Dynamic ARP Inspection (DAI) plays a crucial role in mitigating man-in-the-middle attacks by preventing the manipulation of ARP (Address Resolution Protocol) messages in a network. ARP is used to map IP addresses to MAC addresses, and attackers can exploit this by sending fraudulent ARP messages, redirecting traffic to their devices and thereby intercepting or modifying communication. DAI works by ensuring that only trusted ARP packets are allowed through the switch's ports, thus validating ARP requests and replies against a trusted database, often populated by DHCP Snooping. While it is indeed true that DHCP Snooping itself helps secure the network by ensuring that only authorized DHCP servers can distribute IP addresses, it’s the combination of DHCP Snooping with Dynamic ARP Inspection that robustly reinforces the network against potential man-in-the-middle threats. DHCP Snooping essentially ensures the integrity of the IP address assignment, and when used with DAI, it ties ARP mappings to legitimate IP-to-MAC bindings, substantially reducing the risk of ARP spoofing. Opposing options, such as ARP spoofing and ARP sniffing, do not offer protective measures; instead, they are techniques used in attacks. Thus, they do not contribute to network security against man