A security analyst investigating intermittent session hijacking on a corporate LAN discovers that a rogue host is answering ARP requests for the default gateway's IP address, causing traffic destined for the gateway to be redirected through the attacker's machine. Which switch-based control would most effectively prevent this attack on the access layer?