Which attack exploits the Dynamic Trunking Protocol (DTP) to negotiate a trunk link with a switch?

• A. Arp Poisoning
• B. MAC Flooding
• C. Double Tagging
• D. Switch Spoofing

Answer: (D)

Dynamic Trunking Protocol negotiation can be abused by someone who connects a rogue device and makes it look like a switch, sending DTP frames to persuade the neighboring port to become a trunk. When the port negotiates as a trunk due to this spoofing, the attacker gains access to traffic from multiple VLANs over that link, effectively performing a switch spoofing attack. The essence of the tactic is impersonating a switch to trigger trunk formation, which is why this option is the best fit. The other exploits operate in different ways: ARP poisoning manipulates address mappings, MAC flooding aims to overwhelm the switch’s CAM table, and double tagging hops between VLANs on an existing trunk rather than negotiating trunking in the first place. Mitigations include disabling DTP, configuring ports as static access or explicitly as trunks with allowed VLANs, and enabling protections like BPDU guard and port security.