To mitigate ARP spoofing on an access switch where Port-channel1 is the uplink, which two configurations should be applied on the access switch? (Choose two.)

ARP spoofing mitigation relies on Dynamic ARP Inspection (DAI) and DHCP Snooping. DHCP Snooping builds a binding table of trusted IP-MAC address pairs from DHCP exchanges. The global command ip dhcp snooping vlan 1-4094 enables snooping for all VLANs, and ip dhcp snooping activates it. The uplink (Port-channel1) must be configured as trusted (ip dhcp snooping trust) because it connects to the legitimate DHCP server. DAI then uses this binding table to validate ARP packets, dropping those with invalid IP-MAC mappings. Globally enabling DAI (ip arp inspection vlan 1-4094) and trusting the uplink (ip arp inspection trust) are essential. Untrusted ports, typically end-user ports, will have ARP packets inspected against the DHCP snooping binding table. The other options either miss critical commands or use incorrect configurations like port security or switchport protected, which are not directly for ARP spoofing mitigation.