Exam 350-701 topic 1 question 462 discussion

Correct The switch forwards ARP packets that it receives on a trusted interface, but does not check them. https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/dynarp.html

DAI determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database, the DHCP snooping binding database. This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the switch. If the ARP packet is received on a trusted interface, the switch forwards the packet without any checks. On untrusted interfaces, the switch forwards the packet only if it is valid. so B is correct!!!

B is correct ...DAI determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database, the DHCP snooping binding database. This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the switch. If the ARP packet is received on a trusted interface, the switch forwards the packet without any checks. On untrusted interfaces, the switch forwards the packet only if it is valid.

A Dynamic ARP Inspection (DAI) is a security feature that helps protect against ARP spoofing attacks by validating ARP packets against an IP-to-MAC address binding table. When a switch receives a spoofed ARP response on a trusted interface, it will check the IP-to-MAC address binding table to see if the source IP address and source MAC address match. If they do not match, the switch will drop the packet as it is determined to be a spoofed packet. This helps to protect the network from man-in-the-middle attacks and other ARP spoofing-based attacks.