Which options are effective in preventing ARP poisoning attacks?

• A. Static tables
• B. Limiting local access
• C. Both A and B
• D. Neither A nor B

Answer: (C)

Preventing ARP poisoning relies on keeping ARP mappings trustworthy and limiting who can observe or tamper with them on the local network. ARP poisoning happens when a device on the same LAN sends forged ARP messages to associate an attacker’s MAC address with a legitimate IP, causing traffic to be misrouted through the attacker.

Static ARP tables lock IP-to-MAC mappings on machines and network devices. When these mappings are fixed, forged ARP replies cannot overwrite them, so the attacker cannot reroute traffic. This is a strong defense for critical hosts, though it can be hard to maintain across many devices.

Limiting local access reduces the chance an attacker can even reach the ARP layer in the first place. By enforcing who can connect to the network (through access controls, port security, VLAN segmentation, and similar measures), you confine ARP traffic to trusted devices and segments, lowering the risk of an adversary being in the same broadcast domain to carry out an ARP spoofing attack.

Together, these approaches address both the trustworthiness of ARP mappings and the exposure of devices to potential attackers, making them an effective combination for mitigating ARP poisoning.