A network engineer is hardening access-layer switches after a security audit found that an attacker on the guest VLAN successfully poisoned the ARP cache of other hosts and intercepted their traffic. The engineer needs to prevent this specific Layer 2 attack while relying on binding information already learned from client DHCP transactions. Which infrastructure security feature should be enabled to directly mitigate the ARP spoofing described?