Cisco CCNA (200-301)Security FundamentalsMedium
A network engineer wants a switch to remember which DHCP-assigned IP-to-MAC-to-VLAN-to-interface mappings are valid so that Dynamic ARP Inspection can validate future ARP packets. Where is this dynamically-learned information stored?
- AIn the DHCP snooping binding database
- BIn the MAC address table
- CIn the running-configuration as static entries
- DIn the ARP cache of the switch's CPU
Show answer & explanationAnswer & explanation
Correct answer: A. In the DHCP snooping binding database
DHCP snooping builds and maintains a binding database (also called the DHCP snooping table) that records IP address, MAC address, lease time, VLAN, and interface for each client that receives an address via a trusted DHCP server. DAI uses this table to validate ARP packets on untrusted ports.
Why the other options are wrong
- B. The MAC address table only maps MAC addresses to switch ports, not IP-to-MAC bindings.
- C. Bindings are learned dynamically and stored in a table, not manually added as static config lines.
- D. The ARP cache stores IP-to-MAC mappings learned via ARP, not DHCP snooping bindings.
DHCP Snooping Binding Database
A table built by DHCP snooping that records trusted IP-to-MAC-to-VLAN-to-port mappings, used by DAI and IP Source Guard for validation.
- Populated from DHCPACK messages on trusted ports
- Used by DAI to validate ARP packets
- Used by IP Source Guard to filter spoofed traffic
Memory trick: The binding table is the switch's 'address book' for DAI to check IDs.