- A
The port shut down because restrict mode always causes err-disable
Why wrong: Restrict mode is less disruptive than shutdown mode. If the configuration had used shutdown, the interface would typically go into an error-disabled state after a violation. Because the scenario says the port stays up/up, shutdown mode is not consistent with the symptoms shown.
- B
Traffic from the unauthorized MAC address is being dropped while the interface remains up
Correct. This is correct. Restrict mode drops unauthorized traffic but does not take the whole interface down. That is why the user sees a live port with no connectivity for the replacement device.
- C
The switch learned the new MAC address automatically and replaced the old sticky entry
Why wrong: Sticky MAC learning does not simply replace the previous secure MAC address whenever a new device appears. The point of sticky learning is to remember approved addresses so the switch can enforce them later. When a different device appears and violates policy, the switch applies the configured violation action rather than casually overwriting the security record.
- D
Port security affects only management traffic, not user traffic
Why wrong: Port security directly affects normal user data traffic on access ports because it controls which source MAC addresses are allowed to send frames through the interface. It is not limited to management traffic.
CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A switch port is configured with port security using these commands:
switchport port-security switchport port-security maximum 1 switchport port-security violation restrict switchport port-security mac-address sticky
A user unplugs a company laptop and connects a different unauthorized device. The interface stays up/up, but the new device has no connectivity.
Which statement best explains what happened?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"best"Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Traffic from the unauthorized MAC address is being dropped while the interface remains up
With a maximum of 1 secure MAC address, the switch learns only the company laptop's MAC via sticky learning. When the unauthorized device is plugged in, it attempts to send traffic with a new source MAC address. Since the maximum is already reached, this triggers a port security violation. In restrict mode, the switch drops frames from the violating source but leaves the interface operational, matching the observed behavior: the interface stays up/up while the unauthorized device cannot pass traffic.
Key principle: Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The port shut down because restrict mode always causes err-disable
Why it's wrong here
Restrict mode is less disruptive than shutdown mode. If the configuration had used shutdown, the interface would typically go into an error-disabled state after a violation. Because the scenario says the port stays up/up, shutdown mode is not consistent with the symptoms shown.
When this WOULD be correct
In a different scenario where the port security mode is set to 'shutdown' instead of 'restrict', a candidate might be asked about the behavior of the port when an unauthorized device is connected. In that case, the port would indeed go into err-disable mode, making this option correct.
- ✓
Traffic from the unauthorized MAC address is being dropped while the interface remains up
Why this is correct
Correct. This is correct. Restrict mode drops unauthorized traffic but does not take the whole interface down. That is why the user sees a live port with no connectivity for the replacement device.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.
- ✗
The switch learned the new MAC address automatically and replaced the old sticky entry
Why it's wrong here
Sticky MAC learning does not simply replace the previous secure MAC address whenever a new device appears. The point of sticky learning is to remember approved addresses so the switch can enforce them later. When a different device appears and violates policy, the switch applies the configured violation action rather than casually overwriting the security record.
When this WOULD be correct
In a different scenario where the switch is configured with 'switchport port-security mac-address <new_mac>' without sticky learning, the new MAC address could replace the old one if the maximum number of secure MAC addresses has not been reached, making this option correct.
- ✗
Port security affects only management traffic, not user traffic
Why it's wrong here
Port security directly affects normal user data traffic on access ports because it controls which source MAC addresses are allowed to send frames through the interface. It is not limited to management traffic.
When this WOULD be correct
In a scenario where a question specifies that port security is configured only for management traffic and does not impact user traffic, this option could be correct. For example, if the exam question states that a specific switch model has a unique configuration that isolates management from user traffic, then this option would apply.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Traffic from the unauthorized MAC address is being dropped while the interface remains upCorrect answer▾
Why this is correct
Correct. This is correct. Restrict mode drops unauthorized traffic but does not take the whole interface down. That is why the user sees a live port with no connectivity for the replacement device.
✗The port shut down because restrict mode always causes err-disableWrong answer — click to see why▾
Why this is wrong here
Restrict mode does not cause the interface to go into err-disable state; it only drops traffic from unauthorized MAC addresses while keeping the interface up. Shutdown mode would cause err-disable, but the scenario states the interface stays up/up.
★ When this WOULD be the correct answer
In a different scenario where the port security mode is set to 'shutdown' instead of 'restrict', a candidate might be asked about the behavior of the port when an unauthorized device is connected. In that case, the port would indeed go into err-disable mode, making this option correct.
Why candidates choose this
Students often confuse restrict mode with shutdown mode, assuming any violation leads to an err-disable state. The term 'restrict' might be misinterpreted as a more severe action than it actually is.
✗The switch learned the new MAC address automatically and replaced the old sticky entryWrong answer — click to see why▾
Why this is wrong here
Sticky MAC learning does not automatically replace existing secure MAC addresses with new ones; it only learns and stores the first MAC addresses seen up to the maximum limit. Once the limit is reached, any new MAC address triggers the violation action (restrict) instead of being learned.
★ When this WOULD be the correct answer
In a different scenario where the switch is configured with 'switchport port-security mac-address <new_mac>' without sticky learning, the new MAC address could replace the old one if the maximum number of secure MAC addresses has not been reached, making this option correct.
Why candidates choose this
Students may think sticky MAC dynamically adapts to any connected device, similar to dynamic MAC learning without security. They might overlook that sticky MAC enforces a fixed set of allowed addresses once learned.
✗Port security affects only management traffic, not user trafficWrong answer — click to see why▾
Why this is wrong here
Port security applies to all user data traffic on the interface, not just management traffic. It filters frames based on source MAC addresses, affecting any traffic from unauthorized devices.
★ When this WOULD be the correct answer
In a scenario where a question specifies that port security is configured only for management traffic and does not impact user traffic, this option could be correct. For example, if the exam question states that a specific switch model has a unique configuration that isolates management from user traffic, then this option would apply.
Why candidates choose this
The term 'management traffic' might be confused with control plane traffic, leading students to think port security only affects protocols like SNMP or SSH. In reality, it operates at the data plane level.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
A common exam trap is assuming that any port security violation immediately disables the port. Candidates often confuse 'restrict' mode with 'shutdown' mode. In 'shutdown' mode, the port goes into an error-disabled state and the interface status changes to down, but in 'restrict' mode, the port remains up and only blocks unauthorized traffic. This subtle difference can mislead test takers into selecting answers that describe the port shutting down, which contradicts the scenario where the interface stays up/up. Recognizing the behavior of each violation mode is crucial to avoid this mistake.
Trap categories for this question
Command / output trap
Restrict mode is less disruptive than shutdown mode. If the configuration had used shutdown, the interface would typically go into an error-disabled state after a violation. Because the scenario says the port stays up/up, shutdown mode is not consistent with the symptoms shown.
Scenario analysis trap
Restrict mode is less disruptive than shutdown mode. If the configuration had used shutdown, the interface would typically go into an error-disabled state after a violation. Because the scenario says the port stays up/up, shutdown mode is not consistent with the symptoms shown.
Detailed technical explanation
How to think about this question
Port security is a Cisco switch feature that restricts input to an interface by limiting and identifying MAC addresses of the stations allowed to access the port. It helps prevent unauthorized devices from connecting to the network by enforcing policies on which MAC addresses can send traffic through a switch port. The 'sticky' option allows the switch to dynamically learn MAC addresses and add them to the running configuration as secure addresses, which persist through reboots if saved. When port security violation mode is set to 'restrict', the switch blocks traffic from unauthorized MAC addresses but keeps the interface operational (up/up). This mode differs from 'shutdown', which disables the port entirely by placing it into an error-disabled state. The 'maximum 2' command limits the number of secure MAC addresses to two, so if a third MAC address appears, the violation action triggers. In this scenario, the unauthorized device’s frames are dropped, but the port remains physically active, explaining why the interface stays up but the device has no connectivity. A common exam trap is confusing the violation modes 'restrict' and 'shutdown'. Many assume any violation causes the port to shut down, but 'restrict' only drops unauthorized traffic and generates a log or SNMP trap without disabling the port. Understanding this distinction is critical for troubleshooting and answering exam questions correctly. Practically, restrict mode allows network administrators to monitor violations without disrupting all users on the port, providing a balance between security and availability.
KKey Concepts to Remember
- Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.
- The 'sticky' MAC address feature dynamically learns and saves secure MAC addresses to the running configuration for persistent security enforcement.
- When port security violation mode is set to 'restrict', the switch blocks unauthorized MAC address traffic but keeps the interface operational and up.
- The 'maximum' command defines how many secure MAC addresses a port can learn before triggering a violation action.
- Violation mode 'shutdown' disables the port by placing it into an error-disabled state, unlike 'restrict' which only drops unauthorized traffic.
- Port security directly controls user data traffic by filtering frames based on source MAC addresses, not just management traffic.
- Sticky MAC addresses are not automatically replaced when a new unauthorized device connects; instead, the violation action is enforced.
- Understanding the difference between violation modes is essential to correctly interpret port behavior during security violations.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Got this wrong? Here's your next step.
Review port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access., then practise related 200-301 questions on the same topic to reinforce the concept.
- →
Network Services and Security — study guide chapter
Learn the concepts, then practise the questions
- →
Network Services and Security practice questions
Targeted practice on this topic area only
- →
All 200-301 questions
1,819 questions across all exam domains
- →
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
- →
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related 200-301 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Network Infrastructure and Connectivity practice questions
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Switching and Network Access practice questions
Practise 200-301 questions linked to Switching and Network Access.
IP Routing practice questions
Practise 200-301 questions linked to IP Routing.
Network Services and Security practice questions
Practise 200-301 questions linked to Network Services and Security.
AI and Network Operations practice questions
Practise 200-301 questions linked to AI and Network Operations.
CCNA subnetting practice questions
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
CCNA OSPF practice questions
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
CCNA VLAN practice questions
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
CCNA STP practice questions
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
CCNA EtherChannel practice questions
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
CCNA ACL practice questions
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
CCNA NAT practice questions
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Start a free 200-301 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this 200-301 question test?
Network Services and Security — This question tests Network Services and Security — Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access..
What is the correct answer to this question?
The correct answer is: Traffic from the unauthorized MAC address is being dropped while the interface remains up — With a maximum of 1 secure MAC address, the switch learns only the company laptop's MAC via sticky learning. When the unauthorized device is plugged in, it attempts to send traffic with a new source MAC address. Since the maximum is already reached, this triggers a port security violation. In restrict mode, the switch drops frames from the violating source but leaves the interface operational, matching the observed behavior: the interface stays up/up while the unauthorized device cannot pass traffic.
What should I do if I get this 200-301 question wrong?
Review port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access., then practise related 200-301 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More 200-301 practice questions
- A switchport connected to another switch should carry multiple VLANs, but it was manually configured as an access port.…
- What problem is HSRP designed to solve?
- Which TWO statements correctly describe the causes or implications of CRC errors, runts, giants, or output errors as see…
- You are connected to R1. Configure IPv4 and IPv6 addressing on R1's interfaces and verify reachability to R2. The curren…
- Which TWO statements accurately describe how AI/ML concepts are applied to network operations in modern enterprise netwo…
- Which TWO switch port configurations are required when connecting a Cisco IP phone and a desktop PC to a single access p…
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.