A rogue device sends forged ARP replies to redirect nearby clients through itself. Which switch feature helps defend against this attack when properly configured?

1. Disabling DNS recursion
2. Port mirroring alone
3. Increasing the spanning-tree root priority
4. Dynamic ARP inspection