Which statement about Dynamic ARP Inspection (DAI) is accurate?

• A. Port security on switches cannot restrict MAC addresses.
• B. ARP spoofing cannot occur if DNSSEC is enabled.
• C. Dynamic ARP Inspection validates ARP packets against a trusted database to block spoofed traffic.
• D. DAI replaces VLANs to isolate traffic.

Answer: (C)

Dynamic ARP Inspection focuses on ARP security by checking each ARP packet against a trusted binding database. This database is built from DHCP snooping information and static entries, creating a map of valid IP-to-MAC addresses. When an ARP reply arrives, DAI compares the claimed IP-to-MAC pairing to that trusted map. If the pair doesn’t match, the packet is dropped, effectively blocking ARP spoofing and preventing a potential man-in-the-middle scenario. This is why the statement about DAI being able to validate ARP packets against a trusted database to block spoofed traffic is the accurate description.

DNSSEC deals with validating DNS responses, not ARP messages at layer 2, so enabling DNSSEC doesn’t stop ARP spoofing. And DAI doesn’t replace VLANs—VLANs continue to segment traffic, while DAI operates within those segments to scrutinize ARP traffic. Port security can restrict MAC addresses, so the idea that port security cannot do that isn’t correct.