Which practice helps prevent VLAN hopping attacks?

Changing the native VLAN to an unused VLAN ID is a key practice to prevent VLAN hopping attacks, specifically the "switch spoofing" type. In this attack, an attacker attempts to trick the switch into believing their host is a trunk port. If successful, the attacker can then send and receive traffic on any VLAN. By default, the native VLAN is often VLAN 1, which is commonly used for management traffic. If an attacker successfully spoofs a trunk port and the native VLAN is in use, they gain access to that VLAN's traffic. By moving the native VLAN to an unused ID, even if an attacker successfully spoofs a trunk, they gain access to a VLAN with no active devices or traffic, effectively isolating them. Dynamic ARP Inspection (DAI) prevents ARP poisoning, not VLAN hopping. Applying an ACL to stop traffic from changing VLANs is not a direct prevention for the underlying mechanism of VLAN hopping; it's a filtering mechanism after a potential breach. Implementing port security on Internet-facing VLANs is good practice for security but doesn't directly address the native VLAN vulnerability in VLAN hopping.