Following reports of inconsistent IP-to-MAC mappings on an internal access switch at a manufacturing company...

The correct answer is Dynamic ARP Inspection, or DAI, because CEH network defense material explains that DAI validates ARP packets against trusted IP-to-MAC bindings, typically built from DHCP snooping. In the scenario, the switch rejects ARP replies when the observed mappings do not match previously learned legitimate assignments. That is exactly how DAI functions. DHCP snooping alone helps build the binding table, but it is not the feature that actively inspects and drops forged ARP traffic. BPDU Guard is unrelated because it protects spanning-tree by shutting down ports that receive unexpected BPDUs, and simply displaying the snooping table is a verification action, not an enforcement mechanism. CEH describes ARP spoofing and poisoning as attacks in which forged ARP packets are used to redirect traffic, impersonate hosts, or support sniffing and man-in-the-middle attacks. DAI is designed specifically to counter that threat by checking ARP messages against known valid bindings before allowing them through the switch. Therefore, the denial behavior described is the operational signature of DAI working with DHCP snooping data.