If ARP is set to reply-only on an interface, what is the effect?

When ARP is configured to "reply-only" on an interface, the device will only respond to ARP requests for IP addresses that are already known or configured as static entries. This means that any new MAC addresses detected on the network will not be added to the ARP table. The device will ignore any ARP requests that could lead to learning new IP-MAC address pairs unless these pairs are already defined in the static ARP list.

This configuration is advantageous in a secure environment where it is important to restrict the ARP table to known entities, helping to prevent ARP spoofing attacks. Hence, it allows for acceptance only of those MAC addresses that have been explicitly defined in the ARP settings, ensuring that only trusted communication is recognized and processed.

The other options imply functions related to adding or accepting new addresses, which are not possible when ARP is set to reply-only. The interface would neither add new MAC addresses nor accept combinations dynamically from the network, thus enhancing security and control over ARP resolution.