switchport port-security switchport port-security maximum 2 switchport port-security violation restrict switchport port-security mac-address sticky
A switch port is configured with port security using these commands:
switchport port-security switchport port-security maximum 2 switchport port-security violation restrict switchport port-security mac-address sticky
A user unplugs a company laptop and connects a different unauthorized device. The interface stays up/up, but the new device has no connectivity.
Which statement best explains what happened?
Answer choices
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
The port shut down because restrict mode always causes err-disable
Restrict mode is less disruptive than shutdown mode. If the configuration had used shutdown, the interface would typically go into an error-disabled state after a violation. Because the scenario says the port stays up/up, shutdown mode is not consistent with the symptoms shown.
Traffic from the unauthorized MAC address is being dropped while the interface remains up
Correct. This is correct. Restrict mode drops unauthorized traffic but does not take the whole interface down. That is why the user sees a live port with no connectivity for the replacement device.
The switch learned the new MAC address automatically and replaced the old sticky entry
Sticky MAC learning does not simply replace the previous secure MAC address whenever a new device appears. The point of sticky learning is to remember approved addresses so the switch can enforce them later. When a different device appears and violates policy, the switch applies the configured violation action rather than casually overwriting the security record.
Port security affects only management traffic, not user traffic
Port security directly affects normal user data traffic on access ports because it controls which source MAC addresses are allowed to send frames through the interface. It is not limited to management traffic.
Common exam trap
A common exam trap is assuming that any port security violation immediately disables the port. Candidates often confuse 'restrict' mode with 'shutdown' mode. In 'shutdown' mode, the port goes into an error-disabled state and the interface status changes to down, but in 'restrict' mode, the port remains up and only blocks unauthorized traffic. This subtle difference can mislead test takers into selecting answers that describe the port shutting down, which contradicts the scenario where the interface stays up/up. Recognizing the behavior of each violation mode is crucial to avoid this mistake.
Technical deep dive
Port security is a Cisco switch feature that restricts input to an interface by limiting and identifying MAC addresses of the stations allowed to access the port. It helps prevent unauthorized devices from connecting to the network by enforcing policies on which MAC addresses can send traffic through a switch port. The 'sticky' option allows the switch to dynamically learn MAC addresses and add them to the running configuration as secure addresses, which persist through reboots if saved. When port security violation mode is set to 'restrict', the switch blocks traffic from unauthorized MAC addresses but keeps the interface operational (up/up). This mode differs from 'shutdown', which disables the port entirely by placing it into an error-disabled state. The 'maximum 2' command limits the number of secure MAC addresses to two, so if a third MAC address appears, the violation action triggers. In this scenario, the unauthorized device’s frames are dropped, but the port remains physically active, explaining why the interface stays up but the device has no connectivity. A common exam trap is confusing the violation modes 'restrict' and 'shutdown'. Many assume any violation causes the port to shut down, but 'restrict' only drops unauthorized traffic and generates a log or SNMP trap without disabling the port. Understanding this distinction is critical for troubleshooting and answering exam questions correctly. Practically, restrict mode allows network administrators to monitor violations without disrupting all users on the port, providing a balance between security and availability.
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practise DHCP scopes, relay, leases and troubleshooting.
Practise routing-table output, longest-prefix match, AD and route selection.
Practise trunk verification and VLAN forwarding across switches.
Practise WLAN security, authentication and wireless architecture concepts.
Practise IPv6 addressing, routes, neighbour discovery and common IPv6 exam traps.
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
Question 2
Question 3
Question 4
Question 5
Question 6
FAQ
Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.
The correct answer is: Traffic from the unauthorized MAC address is being dropped while the interface remains up — The important clue is the violation mode: restrict. In Cisco port security, restrict mode does not shut the entire interface down the way shutdown mode does. Instead, it blocks traffic from unauthorized source MAC addresses while keeping the interface itself operational. Sticky learning means the switch has already learned approved MAC addresses and remembers them as secure addresses. When a different device appears, the switch sees frames from a source that does not belong on that port under the current policy. In plain language, the port remains physically up, but the new device is not allowed to use it. That matches the symptom exactly: the interface looks normal, yet the unauthorized endpoint cannot pass traffic.
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Sign in to join the discussion.