Which is a common mitigation for ARP spoofing?

• A. DNSSEC
• B. MAC filtering
• C. VPN tunneling
• D. Dynamic ARP Inspection

Answer: (D)

ARP spoofing is stopped by validating ARP messages as they pass through the network. Dynamic ARP Inspection sits on the switch and watches ARP replies, checking them against a trusted source of mappings—typically the DHCP snooping binding table or static entries. If an ARP reply claims an IP is associated with a different MAC than what’s in the trusted data, that reply is dropped. This prevents an attacker from teaching devices to send traffic to the wrong MAC, stopping man-in-the-middle risks at the LAN level.

DNSSEC signs DNS responses to prevent DNS spoofing, which is a different layer problem; MAC filtering alone can be bypassed and doesn’t provide the dynamic verification ARP needs; VPN tunneling protects data in transit but doesn’t fix ARP-level trust on a local network. Dynamic ARP Inspection directly targets the ARP trust issue, making it the best fit.