Explanation:
The matching is based on identifying the attack layer and then choosing the control that blocks that behavior.
Dynamic ARP Inspection validates ARP messages against trusted bindings and is used against ARP spoofing or poisoning, a common man-in-the-middle technique on Layer 2 segments. DHCP snooping builds the trusted binding table and blocks unauthorized DHCP server behavior. Port security limits which MAC addresses can use a switchport, reducing exposure to MAC flooding or unauthorized endpoint attachment.
Changing the native VLAN or using proper trunk controls helps mitigate VLAN hopping and double-tagging attacks, because the attacker relies on trunk/native VLAN behavior to cross VLAN boundaries. Cisco CCNA v1.1 Network Access includes switch security features such as DHCP snooping, DAI, and port security. The practical approach is not to memorize coordinates in a drag-and-drop map. Identify the malicious mechanism first, then map it to the feature that checks or constrains that exact mechanism.

In this attack, the attacking computer generates frames with two 802.1Q tags. The first tag matches the native VLAN of the trunk port (VLAN 10 in this case), and the second matches the VLAN of a host it wants to attack (VLAN 20).