A recent penetration test identified that an attacker could flood the MAC address table of network switches. Which of the following would best mitigate this type of attack?

Port security is the best mitigation because it restricts the number of MAC addresses that can be learned on a switch port and can bind specific MAC addresses to a port. This prevents an attacker from flooding the MAC address table (MAC flooding) by sending numerous forged MAC addresses, which would otherwise cause the switch to act like a hub and broadcast all traffic, allowing the attacker to eavesdrop. A load balancer distributes network traffic and does not address MAC table overflow. An IPS (Intrusion Prevention System) might detect the attack but doesn't prevent the MAC table from being flooded. An NGFW (Next-Generation Firewall) primarily focuses on higher-layer traffic inspection and access control, not Layer 2 MAC address table protection.