Does this DHCP Server need a trusted ARP Inspection port in IOS?

Question

The switch runs Cisco IOS. You want to configure security on Switch 1. The objective is configuring Dynamic ARP Inspection on Switch 1. Which Ports or port will you configure as Trusted?

A) None of the Ports
B) All of the Ports
C) Ports Fa1/1, Fa1/2, Fa1/3, Fa1/4
D) Port Fa2/1

The Correct answer as stated by the question's source is Option D (Port Fa2/1). I think None of the ports need to be configured as trusted. DAI validates the ARP message with the DHCP Snooping Binding Table on untrusted ports. But, since Port Fa2/1 is connected to a DHCP Server, it doesn't matter. If we were configuring DHCP Snooping, it makes sense to configure Port Fa2/1 as trusted so it'll allow DHCP Server messages to flow. Why am I wrong?

Answer 1

Dynamic ARP inspection is based on DHCP snooping. The switch snoops DHCP and ensures that all nodes can only use the IP address they are granted by DHCP.

DHCP snooping requires a host or port to be configured as trusted. Only that host can issue DHCP leases. In your scenario the DHCP server is located on switch 1's Fa2/1, so that's the port to trust. DAI doesn't use any trust of its own.