CCNA Network Services and Security Practice Question
A switch port is configured with port security using these commands:
switchport port-security switchport port-security maximum 1 switchport port-security violation restrict switchport port-security mac-address sticky
A user unplugs a company laptop and connects a different unauthorized device. The interface stays up/up, but the new device has no connectivity.
Which statement best explains what happened?
⚠ Common exam trap
A common exam trap is assuming that any port security violation immediately disables the port. Candidates often confuse 'restrict' mode with 'shutdown' mode. In 'shutdown' mode, the port goes into an error-disabled state and the interface status changes to down, but in 'restrict' mode, the port remains up and only blocks unauthorized traffic. This subtle difference can mislead test takers into selecting answers that describe the port shutting down, which contradicts the scenario where the interface stays up/up. Recognizing the behavior of each violation mode is crucial to avoid this mistake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic from the unauthorized MAC address is being dropped while the interface remains up
With a maximum of 1 secure MAC address, the switch learns only the company laptop's MAC via sticky learning. When the unauthorized device is plugged in, it attempts to send traffic with a new source MAC address. Since the maximum is already reached, this triggers a port security violation. In restrict mode, the switch drops frames from the violating source but leaves the interface operational, matching the observed behavior: the interface stays up/up while the unauthorized device cannot pass traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The port shut down because restrict mode always causes err-disable
Why it's wrong here
Restrict mode is less disruptive than shutdown mode. If the configuration had used shutdown, the interface would typically go into an error-disabled state after a violation. Because the scenario says the port stays up/up, shutdown mode is not consistent with the symptoms shown.
When this WOULD be correct
In a different scenario where the port security mode is set to 'shutdown' instead of 'restrict', a candidate might be asked about the behavior of the port when an unauthorized device is connected. In that case, the port would indeed go into err-disable mode, making this option correct.
- ✓
Traffic from the unauthorized MAC address is being dropped while the interface remains up
Why this is correct
In port-security restrict mode, the switch forwards legitimate traffic from authorized MAC addresses while silently discarding frames from any unauthorized source MAC, and it increments the security-violation counter. Crucially, the interface remains in the up/up state because restrict mode does not error-disable the port, which exactly matches the symptom of a live interface that cannot pass traffic for the replacement device. This behavior differs from shutdown mode, which would place the port in err-disabled state, and from protect mode, which also drops but does not increment the violation counter.
- ✗
The switch learned the new MAC address automatically and replaced the old sticky entry
Why it's wrong here
Sticky MAC learning does not simply replace the previous secure MAC address whenever a new device appears. The point of sticky learning is to remember approved addresses so the switch can enforce them later. When a different device appears and violates policy, the switch applies the configured violation action rather than casually overwriting the security record.
When this WOULD be correct
In a different scenario where the switch is configured with 'switchport port-security mac-address <new_mac>' without sticky learning, the new MAC address could replace the old one if the maximum number of secure MAC addresses has not been reached, making this option correct.
- ✗
Port security affects only management traffic, not user traffic
Why it's wrong here
Port security does not distinguish or filter based on traffic type such as management versus user data; instead, it operates at Layer 2 on every Ethernet frame that ingresses the port, checking the source MAC address against the configured secure addresses. Management traffic (e.g., SSH, SNMP, CDP) and user traffic (e.g., HTTP, FTP) all arrive as frames with a source MAC, so port security enforces the MAC allowlist on all of them equally. Therefore, the notion that only management traffic is affected is incorrect; any frame from an unauthorized source MAC is subject to the configured violation action, regardless of the upper-layer protocol.
When this WOULD be correct
In a scenario where a question specifies that port security is configured only for management traffic and does not impact user traffic, this option could be correct. For example, if the exam question states that a specific switch model has a unique configuration that isolates management from user traffic, then this option would apply.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Traffic from the unauthorized MAC address is being dropped while the interface remains upCorrect answer▾
Why this is correct
In port-security restrict mode, the switch forwards legitimate traffic from authorized MAC addresses while silently discarding frames from any unauthorized source MAC, and it increments the security-violation counter. Crucially, the interface remains in the up/up state because restrict mode does not error-disable the port, which exactly matches the symptom of a live interface that cannot pass traffic for the replacement device. This behavior differs from shutdown mode, which would place the port in err-disabled state, and from protect mode, which also drops but does not increment the violation counter.
✗The port shut down because restrict mode always causes err-disableWrong answer — click to see why▾
Why this is wrong here
Restrict mode does not cause the interface to go into err-disable state; it only drops traffic from unauthorized MAC addresses while keeping the interface up. Shutdown mode would cause err-disable, but the scenario states the interface stays up/up.
★ When this WOULD be the correct answer
In a different scenario where the port security mode is set to 'shutdown' instead of 'restrict', a candidate might be asked about the behavior of the port when an unauthorized device is connected. In that case, the port would indeed go into err-disable mode, making this option correct.
Why candidates choose this
Students often confuse restrict mode with shutdown mode, assuming any violation leads to an err-disable state. The term 'restrict' might be misinterpreted as a more severe action than it actually is.
✗The switch learned the new MAC address automatically and replaced the old sticky entryWrong answer — click to see why▾
Why this is wrong here
Sticky MAC learning does not automatically replace existing secure MAC addresses with new ones; it only learns and stores the first MAC addresses seen up to the maximum limit. Once the limit is reached, any new MAC address triggers the violation action (restrict) instead of being learned.
★ When this WOULD be the correct answer
In a different scenario where the switch is configured with 'switchport port-security mac-address <new_mac>' without sticky learning, the new MAC address could replace the old one if the maximum number of secure MAC addresses has not been reached, making this option correct.
Why candidates choose this
Students may think sticky MAC dynamically adapts to any connected device, similar to dynamic MAC learning without security. They might overlook that sticky MAC enforces a fixed set of allowed addresses once learned.
✗Port security affects only management traffic, not user trafficWrong answer — click to see why▾
Why this is wrong here
Port security applies to all user data traffic on the interface, not just management traffic. It filters frames based on source MAC addresses, affecting any traffic from unauthorized devices.
★ When this WOULD be the correct answer
In a scenario where a question specifies that port security is configured only for management traffic and does not impact user traffic, this option could be correct. For example, if the exam question states that a specific switch model has a unique configuration that isolates management from user traffic, then this option would apply.
Why candidates choose this
The term 'management traffic' might be confused with control plane traffic, leading students to think port security only affects protocols like SNMP or SSH. In reality, it operates at the data plane level.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
MAC address
A MAC address is a unique hardware identifier assigned to a network interface card that allows devices to communicate on a local network.
Key term
Port security
Port security is a network switch feature that restricts which devices can connect to a port based on the device's MAC address, preventing unauthorized access.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.