Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: Dynamic ARP InspectionSwitch
All CCNA topics

4.0 Network Services and Security

Dynamic ARP Inspection Practice Questions

Preventing ARP spoofing using the DHCP snooping binding table.

CCNA v2.0 objective 4.7.b · objective map

Author-reviewed by LabFabric · 7 September 2026 · Report a content issue

One solved question, so you can see how these are marked

In a DHCP-based access VLAN, what is the primary purpose of Dynamic ARP Inspection (DAI) on untrusted switch ports?

To reject ARP mappings that fail DHCP snooping binding checks

DAI intercepts ARP on untrusted ports and, in this DHCP-based design, validates claimed bindings against the DHCP snooping database. Invalid ARP packets are dropped. Static hosts can require ARP ACLs or other platform-supported binding configuration.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

Find related practice in the CCNA path
All 7 Dynamic ARP Inspection questions in this set

Answers and explanations appear when you work through the set above.

  1. Why is a populated DHCP snooping binding table normally required for DAI to permit ARP from dynamically addressed clients on untrusted ports?

    • DAI does not consult DHCP bindings
    • It supplies trusted IP-to-MAC bindings for client ARP validation
    • DAI needs DHCP snooping disabled
    • It supplies VLAN assignments for trunks rather than ARP bindings

  2. Which command enables Dynamic ARP Inspection for VLAN 1 on a switch?

    • ip arp inspection enable vlan 1
    • ip arp inspection vlan 1
    • arp inspection vlan 1
    • ip dhcp snooping arp vlan 1

  3. An administrator runs ip arp inspection validate dst-mac ip src-mac on a switch. What does this add beyond basic DAI operation?

    • It inserts DHCP option 82 with the source MAC, destination MAC and client IP into each inspected ARP frame
    • It adds MAC-field consistency and IP-address validity checks beyond binding lookup
    • It trusts interfaces whose source and destination MAC fields appear in the local MAC address table
    • It disables ARP inspection logging

  4. An access switch's uplink leads only toward the trusted distribution layer and legitimate gateways. Which interface command makes DAI accept ARP received from that trusted direction without binding checks?

    • ip arp inspection trust
    • ip dhcp snooping trust only, with no DAI-specific command needed
    • ip arp inspection limit rate 0
    • switchport mode trunk

  5. After DAI is enabled on VLAN 10, a printer with a statically configured IP address can no longer reach its gateway, while DHCP clients work normally. What is the most likely cause?

    • DAI blocks all ARP from printers because they use a different ARP format
    • The printer's port must be configured as a trunk for DAI to inspect its ARP packets
    • DAI disables proxy ARP on the gateway, which static hosts depend on
    • Its ARP lacks a validating snooping binding on the untrusted port

  6. Which command shows how many ARP packets DAI has forwarded and dropped per VLAN?

    • show ip arp inspection statistics
    • show ip dhcp snooping binding
    • show arp detail
    • show ip arp inspection interfaces

  7. A client port was err-disabled shortly after DAI was enabled, and the log shows %SW_DAI-4-PACKET_RATE_EXCEEDED. What caused the shutdown?

    • The port received ARP from a MAC address listed in the DHCP snooping binding table
    • Its ARP arrival rate exceeded the untrusted-port limit
    • The port is a trusted interface that tried to forward DHCP server replies
    • The ARP packets carried a VLAN tag that did not match the access VLAN