Which combination of ARP poisoning prevention methods is most effective?

• A. Static tables only
• B. Limiting local access only
• C. Both static tables and limiting local access
• D. Neither method

Answer: (C)

ARP poisoning happens when an attacker on the same LAN sends spoofed ARP replies to associate their MAC with another device’s IP, so traffic is misdirected through the attacker. A static ARP table hard-codes the correct IP-to-MAC mappings, so the host won’t update its ARP entry in response to spoofed replies. That makes spoofing much less effective for those devices. But keeping ARP static is hard to scale and can break if devices change, so it isn’t a complete solution by itself.

Limiting local access reduces how many devices can participate on the same broadcast domain. Techniques like VLANs, access controls, and port security shrink the number of potential spoofers and place tighter controls on who can send ARP traffic, making spoofing harder to pull off in the first place.

Using both approaches together gives defense in depth: static entries protect critical hosts from ARP updates being poisoned, while restricting local access lowers the overall exposure and makes spoofing harder across the network. This combination is more effective than either method alone.