Skip to content
AvailabilitySign inBook a DemoJoin Waitlist
All CCNA topics

4.0 Network Services and Security

Dynamic ARP Inspection Practice Questions

Preventing ARP spoofing using the DHCP snooping binding table.

CCNA v2.0 objective 4.7.b · objective map

Author-reviewed by LabFabric · 7 September 2026 · Report a content issue

One solved question, so you can see how these are marked

In a DHCP-based access VLAN, what is the primary purpose of Dynamic ARP Inspection (DAI) on untrusted switch ports?

To validate ARP packets against the DHCP snooping binding table and drop ones with mismatched IP-to-MAC mappings

DAI intercepts ARP on untrusted ports and, in this DHCP-based design, validates claimed bindings against the DHCP snooping database. Invalid ARP packets are dropped. Static hosts can require ARP ACLs or other platform-supported binding configuration.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

Find related practice in the CCNA path
All 7 Dynamic ARP Inspection questions in this set

Answers and explanations appear when you work through the set above.

  1. Why is a populated DHCP snooping binding table normally required for DAI to permit ARP from dynamically addressed clients on untrusted ports?

    • DAI never uses DHCP snooping data
    • Those clients need trusted IP-to-MAC bindings against which DAI can validate their ARP packets
    • DHCP snooping must be disabled for DAI to function
    • DAI uses DHCP snooping only to assign VLANs to trunk ports

  2. Which command enables Dynamic ARP Inspection for VLAN 1 on a switch?

    • ip arp inspection enable vlan 1
    • ip arp inspection vlan 1
    • arp inspection vlan 1
    • ip dhcp snooping arp vlan 1

  3. An administrator runs ip arp inspection validate dst-mac ip src-mac on a switch. What does this add beyond basic DAI operation?

    • It enables DHCP snooping information option insertion
    • It adds extra validation checks confirming the destination MAC, IP address fields, and source MAC in the ARP packet are consistent, not just the IP-to-MAC binding
    • It trusts all interfaces automatically
    • It disables ARP inspection logging

  4. An access switch's uplink leads only toward the trusted distribution layer and legitimate gateways. Which interface command makes DAI accept ARP received from that trusted direction without binding checks?

    • ip arp inspection trust
    • ip dhcp snooping trust only, with no DAI-specific command needed
    • ip arp inspection limit rate 0
    • switchport mode trunk

  5. After DAI is enabled on VLAN 10, a printer with a statically configured IP address can no longer reach its gateway, while DHCP clients work normally. What is the most likely cause?

    • DAI blocks all ARP from printers because they use a different ARP format
    • The printer's port must be configured as a trunk for DAI to inspect its ARP packets
    • DAI disables proxy ARP on the gateway, which static hosts depend on
    • The printer has no DHCP snooping binding, so its ARP fails validation on the untrusted port

  6. Which command shows how many ARP packets DAI has forwarded and dropped per VLAN?

    • show ip arp inspection statistics
    • show ip dhcp snooping binding
    • show arp detail
    • show ip arp inspection trust

  7. A client port was err-disabled shortly after DAI was enabled, and the log shows %SW_DAI-4-PACKET_RATE_EXCEEDED. What caused the shutdown?

    • The port received ARP from a MAC address listed in the DHCP snooping binding table
    • The port received more ARP packets per second than the DAI rate limit for untrusted ports
    • The port is a trusted interface that tried to forward DHCP server replies
    • The ARP packets carried a VLAN tag that did not match the access VLAN