CCNA Switching and Network Access Practice Question
A switch port connected to a workstation is configured with sticky MAC learning and a maximum secure MAC count of 1. What is the main operational benefit of sticky learning in this case?
⚠ Common exam trap
Be careful not to confuse sticky learning with allowing multiple MAC addresses or automatic removal of unauthorized addresses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It dynamically learns a secure MAC address and can preserve it if the configuration is saved.
Sticky learning gives the convenience of dynamic discovery while still treating the learned address as a secure port-security entry. In practical terms, the switch can observe the first legitimate MAC address on the port and record it as a secure address without the administrator having to type that address manually. If the running configuration is later saved, that sticky entry can persist after a reload. This is useful because it balances ease of deployment with access control. The maximum secure MAC count still matters, and port security is still active. Sticky learning does not replace port security; it works within it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It dynamically learns a secure MAC address and can preserve it if the configuration is saved.
Why this is correct
Sticky port-security dynamically learns the MAC address of the connected workstation and converts it into a secure MAC address entry in the running configuration. If the configuration is saved to startup-config, the learned address persists across reboots, preventing the need to relearn it. This behavior is characteristic of sticky learning, which combines dynamic learning with static persistence.
- ✗
It disables the maximum secure MAC limit on the interface.
Why it's wrong here
Sticky MAC learning does not disable or modify the maximum secure MAC address limit configured on the interface. The switch still enforces the configured maximum, and when that limit is reached, it will not learn additional addresses. If a new device attempts to connect after the limit is exhausted, the port will treat it as a violation, just as it would without sticky learning.
When this WOULD be correct
In a different scenario where the question states that sticky MAC learning is configured without a maximum secure MAC count, option B could be correct if the context implies that the sticky learning process allows for unlimited MAC addresses to be learned, effectively disabling any limit.
- ✗
It automatically saves the running configuration to the startup configuration after learning the MAC address.
Why it's wrong here
Sticky learning only stores the learned MAC addresses in the running configuration; it does not automatically write them to the startup configuration. The switch operator must explicitly issue a copy running-config startup-config or write memory command to preserve the sticky entries across a reload. Without this manual step, the learned addresses are lost when the switch restarts.
When this WOULD be correct
In a different scenario where a switch port is configured to allow multiple MAC addresses and the question specifically states that the port can be converted to trunk mode after learning a MAC, then option C could be correct, indicating a feature of dynamic port configuration.
- ✗
It prevents the port from ever generating a security violation.
Why it's wrong here
Sticky port-security does not eliminate the possibility of security violations. If the number of devices connected exceeds the configured maximum secure MAC address limit, or if a MAC address not in the secure table attempts to send traffic after the port has reached its limit, the port will still trigger a violation. The sticky feature simply automates the initial learning of addresses; it does not bypass the enforcement mechanisms.
When this WOULD be correct
In a different scenario where a switch port is specifically configured to disable all security features, including sticky learning, the option could be correct if the question states that the port is designed to never generate security violations regardless of MAC address changes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓It dynamically learns a secure MAC address and can preserve it if the configuration is saved.Correct answer▾
Why this is correct
Sticky port-security dynamically learns the MAC address of the connected workstation and converts it into a secure MAC address entry in the running configuration. If the configuration is saved to startup-config, the learned address persists across reboots, preventing the need to relearn it. This behavior is characteristic of sticky learning, which combines dynamic learning with static persistence.
✗It disables the maximum secure MAC limit on the interface.Wrong answer — click to see why▾
Why this is wrong here
Option B is incorrect because sticky MAC learning does not disable the maximum secure MAC limit; it simply allows the switch to learn and retain the MAC address within that limit. The maximum secure MAC count remains enforced regardless of sticky learning.
★ When this WOULD be the correct answer
In a different scenario where the question states that sticky MAC learning is configured without a maximum secure MAC count, option B could be correct if the context implies that the sticky learning process allows for unlimited MAC addresses to be learned, effectively disabling any limit.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of how sticky MAC learning interacts with security features, mistakenly believing that sticky learning inherently removes restrictions on MAC address limits.
✗It automatically saves the running configuration to the startup configuration after learning the MAC address.Wrong answer — click to see why▾
Why this is wrong here
Sticky learning does not automatically save the running configuration; it only adds the learned MAC to the running configuration, which must be explicitly saved to the startup configuration to persist across reboots.
★ When this WOULD be the correct answer
In a different scenario where a switch port is configured to allow multiple MAC addresses and the question specifically states that the port can be converted to trunk mode after learning a MAC, then option C could be correct, indicating a feature of dynamic port configuration.
Why candidates choose this
Candidates may find this option tempting because they might confuse sticky MAC learning with dynamic trunking protocols, leading them to believe that learning a MAC address could trigger a change in the port type.
✗It prevents the port from ever generating a security violation.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because sticky MAC learning does not prevent security violations; it only allows the learned MAC address to be retained across reboots if saved. A security violation can still occur if an unauthorized MAC address is detected on the port.
★ When this WOULD be the correct answer
In a different scenario where a switch port is specifically configured to disable all security features, including sticky learning, the option could be correct if the question states that the port is designed to never generate security violations regardless of MAC address changes.
Why candidates choose this
Candidates may be drawn to this option because they associate sticky learning with enhanced security features, mistakenly believing that it inherently prevents any violations on the port.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Common DNS Record Types
| Record | Purpose | Example |
|---|---|---|
| A | IPv4 address mapping | example.com → 93.184.216.34 |
| AAAA | IPv6 address mapping | example.com → 2606:2800::1 |
| CNAME | Alias to another hostname | www → example.com |
| MX | Mail server for domain | example.com → mail.example.com (priority 10) |
| TXT | Text data (SPF, DKIM, verification) | v=spf1 include:_spf.example.com ~all |
| NS | Authoritative name servers | example.com NS ns1.example.com |
| PTR | Reverse DNS (IP → hostname) | 34.216.184.93.in-addr.arpa → example.com |
| SOA | Zone authority record | Primary NS, admin email, serial, TTL defaults |
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Port security
Port security is a network switch feature that restricts which devices can connect to a port based on the device's MAC address, preventing unauthorized access.
Key term
MAC address
A MAC address is a unique hardware identifier assigned to a network interface card that allows devices to communicate on a local network.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.