Which action prevents VLAN hopping attacks?

Assigning the native VLAN to an unused VLAN ID is a key defense against VLAN hopping. In VLAN hopping, an attacker sends frames tagged with a different VLAN ID than the native VLAN, hoping the switch will forward them. By making the native VLAN an unused ID, any frames sent on this VLAN will not reach legitimate devices, effectively isolating the attack. Applying port security helps prevent unauthorized devices from connecting but doesn't directly stop VLAN hopping. Dynamic ARP inspection protects against ARP spoofing, not VLAN hopping. While ACLs can filter traffic, they are not the primary or most effective mechanism to prevent the underlying vulnerability of VLAN tag manipulation in VLAN hopping attacks.