Comprehensive and Detailed Explanation:
# The Best Protection Against MITM and Spoofing Attacks:# (D) Associating DHCP Snooping with IPSG (IP Source Guard) and DAI (Dynamic ARP Inspection) provides complete protection by:
* Blocking rogue DHCP servers.
* Preventing MAC/IP spoofing.
* Ensuring only valid clients access the network.
# Why Not Other Options?# (A) Configuring trusted/untrusted interfaces only helps block rogue DHCP servers, but does not prevent spoofing.# (B) Limiting MAC address learning prevents MAC flooding, but does not stop MITM attacks.# (C) Checking the CHADDR field in DHCP Snooping helps detect spoofed requests, but does not block all MITM scenarios.
# Reference: Huawei HCIE Datacom - Security Mechanisms for Intranet Protection