Certified Ethical Hacker (CEH) Practice Question

Dynamic ARP Inspection (DAI) intercepts every ARP packet received on an access switch, checks each request or reply against the trusted DHCP-snooping binding table or static mappings, and discards any packet with mismatching IP-to-MAC information. Because the validation happens inside the switch, no changes are necessary on servers or workstations. 802.1X authenticates devices at link-up but does not inspect subsequent ARP traffic, so a compromised or unauthenticated host could still poison caches. Private VLAN edge simply blocks direct host-to-host Layer-2 traffic and cannot stop forged ARP replies sent to the default gateway. Port security with sticky or static MAC addresses limits the number of addresses per port but does not verify that ARP messages advertise legitimate IP-MAC bindings. Therefore, only Dynamic ARP Inspection directly prevents the described sniffing technique.