Dynamic ARP Inspection (DAI) inspects ARP traffic to prevent ARP spoofing.

• A. In the application layer validating DNS
• B. At layer 2, inspecting ARP against a binding table
• C. At layer 3, by filtering IPs
• D. On the transport layer inspecting TCP options

Answer: (B)

Dynamic ARP Inspection operates at the data link layer on switches. It inspects ARP traffic and validates ARP replies against a binding table that maps IP addresses to MAC addresses, with the table populated by DHCP snooping or static entries. When an ARP reply arrives, DAI checks that the sender’s MAC matches the expected binding for that IP; if it doesn’t, the packet is dropped, preventing ARP spoofing and the creation of poisoned ARP caches.

Other options don’t fit because DNS validation happens at the application layer and concerns name resolution, not ARP; filtering at layer 3 would target IP headers, not ARP packets; inspecting TCP options occurs at the transport layer, which is unrelated to ARP traffic.