Certified Network Defender (C|ND)

A network defender investigating a switched LAN discovers that an attacker has flooded the switch with a large volume of fabricated MAC addresses, causing the switch's CAM table to overflow and forcing it to behave like a hub. Which attack technique is being carried out?

During a network attack investigation, a defender observes that an attacker is sending forged ARP replies to associate the attacker's MAC address with the default gateway's IP so that traffic is intercepted. Which countermeasure activity from the curriculum directly addresses recognizing this attack?