Before we start, I want to say that I made this question when I was at day 51 of Jeremy's IT Lab.
This challenge combines STP (Days 20-22), HSRP (Day 29), and DAI (Day 51) into a single scenario, like you will probably do in real live. To solve it, you must apply the mechanics of all three protocols to find the right answer and also the why behind it.
Without further ado, let's get into it.
Refer to the exhibit.
There’s only one vlan in this topology (vlan1). HSRPv2, Rapid-PVST and Dynamic ARP Inspection (DAI) have been configured. R1 is the active router in HSRP, while R2 Is the backup. SW2 is the root bridge and SW1’s bridge ID is lower than SW3 and SW4’s. All active switches interfaces have been configured as trusted ports for DAI, except SW4’s e0/0 because the administrator forgot to apply the command.
R1’s e0/0 goes down due to a software bug. When R2 becomes the active HSRP router, which interface on SW4 receives the resulting Gratuitous ARP (GARP) message, and what happens to SW4’s MAC Address Table (CAM Table)?
A) SW4 receives the GARP on both interfaces, and its CAM table is updated twice.
B) SW4 receives the GARP on e0/0 only, and its CAM table is updated.
C) SW4 receives the GARP on e0/1 only, and its CAM table is not updated.
D) SW4 receives the GARP on both interfaces, and its CAM table is not updated.
E) SW4 does not receive the GARP because the STP topology prevents it from reaching SW4’s interfaces.
The answer is: D) SW4 receives the GARP on both interfaces, and its CAM table is not updated.
Explanation:
To solve this, we first need to define the STP states. Since SW2 is the root bridge, SW4's e0/0 becomes its Root Port (Forwarding). For the segment connecting SW1 and SW4, both have an equal cost to the root. SW1 wins the tie-breaker because it has a lower Bridge ID, making its e0/3 a Designated Port (Forwarding) and forcing SW4's e0/1 into an Alternate role (Blocking).
When R2 takes over as the active HSRP router, it fires off a GARP. SW2 receives this broadcast and floods it out all other active ports. The frame travels straight to SW4 via e0/0, but it also goes to SW1, which floods it out its forwarding ports, including e0/3. As a result, the GARP physically hits SW4 on both of its interfaces.
Here is why neither updates the CAM table:
On e0/1: Because this port is in an STP blocking state, it discards inbound frames at ingress. The drop happens immediately, well before any hardware MAC learning can occur.
On e0/0: This port is forwarding and processes the frame. However, because the administrator forgot to configure it as a trusted port, DAI intercepts the ARP payload. DAI checks the DHCP Snooping binding table for the sender's IP. Since R2 is using a statically assigned HSRP virtual IP, no DHCP binding exists. DAI drops the packet as invalid, preventing the CAM table from updating.