DRAG DROP Drag and drop the attack-mitigation techniques from the left onto the Types of attack that they mitigate on the right.

Double-Tagging VLAN Hopping: This attack exploits the way switches process 802.1Q tags on the native VLAN. By changing the native VLAN to an unused ID (not the default VLAN 1), the attacker's double-tagged frames are dropped or misdirected, neutralizing the exploit.

MAC Flooding: While Port Security is a direct mitigation, 802.1x authentication effectively mitigates this by enforcing strict access control. It prevents unauthorized devices (which might run flooding tools like macof) from connecting to the network and injecting frames to overflow the CAM table.

Man-in-the-Middle (MITM): DHCP snooping specifically mitigates MITM attacks caused by rogue DHCP servers (DHCP spoofing). It validates DHCP messages and builds a binding database used to block untrusted DHCP traffic.

Switch Spoofing: This relies on the Dynamic Trunking Protocol (DTP) to negotiate a trunk link. Disabling DTP (using switchport nonegotiate) prevents an attacker from tricking the switch into forming a trunk.

Cisco Systems, Inc., "Layer 2 Security Configuration Guide, Cisco IOS Release 15.0S," Configuring DHCP Snooping, Chapter 2. (Confirms DHCP snooping prevents rogue DHCP servers, a primary vector for MITM).

Cisco Systems, Inc., "VLAN Configuration Guide, Cisco IOS Release 15.1," Configuring VLANs. (Documents the recommendation to change the native VLAN to an unused ID to prevent 802.1Q double-tagging).

Cisco Networking Academy, CCNA Security v2.0 Courseware, Chapter 10: Layer 2 Security. (Explicitly maps DTP disabling to switch spoofing mitigation and 802.1x as an access control measure against flooding/unauthorized access).

S. Yusuf, CCNA Security 210-260 Official Cert Guide, Cisco Press, 2015, pp. 145-148. (Discusses VLAN hopping mitigation and the use of native VLAN tagging/pruning).