Which of the following is a countermeasure for ARP spoofing?

• A. Use dynamic IP addressing
• B. Disable ARP on the network
• C. Use static ARP tables
• D. Use default passwords

Answer: (C)

ARP spoofing works by poisoning the ARP cache, tricking devices into linking an attacker’s MAC address with a legitimate IP so traffic gets sent to the wrong place. A solid way to counter this is to use static ARP entries, where the IP-to-MAC bindings are manually configured and not overwritten by ARP replies. With static mappings, a device will ignore unsolicited ARP updates that try to change who owns an IP, making it much harder for an attacker to impersonate another host. This approach is especially effective on critical hosts or gateways where you must tightly control who is associated with each IP, though it does require careful maintenance across the network.

Other options don’t provide reliable protection against ARP spoofing: dynamic IP addressing by itself doesn’t stop spoofing and can even complicate trust; disabling ARP would cripple normal network operation; and default passwords address authentication but not the integrity of ARP mappings.