Question 143 of 1,819
Network Services and SecurityhardMultiple ChoiceObjective-mapped

CCNA Network Services and Security Practice Question

This 200-301 practice question tests your understanding of network services and security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A switch port is configured with port security using these commands:

switchport port-security
switchport port-security maximum 1
switchport port-security violation restrict
switchport port-security mac-address sticky

A user unplugs a company laptop and connects a different unauthorized device. The interface stays up/up, but the new device has no connectivity.

Which statement best explains what happened?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

  • Clue: "best"

    Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

Question 1hardmultiple choice
Full question →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Traffic from the unauthorized MAC address is being dropped while the interface remains up

With a maximum of 1 secure MAC address, the switch learns only the company laptop's MAC via sticky learning. When the unauthorized device is plugged in, it attempts to send traffic with a new source MAC address. Since the maximum is already reached, this triggers a port security violation. In restrict mode, the switch drops frames from the violating source but leaves the interface operational, matching the observed behavior: the interface stays up/up while the unauthorized device cannot pass traffic.

Key principle: Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The port shut down because restrict mode always causes err-disable

    Why it's wrong here

    Restrict mode is less disruptive than shutdown mode. If the configuration had used shutdown, the interface would typically go into an error-disabled state after a violation. Because the scenario says the port stays up/up, shutdown mode is not consistent with the symptoms shown.

    When this WOULD be correct

    In a different scenario where the port security mode is set to 'shutdown' instead of 'restrict', a candidate might be asked about the behavior of the port when an unauthorized device is connected. In that case, the port would indeed go into err-disable mode, making this option correct.

  • Traffic from the unauthorized MAC address is being dropped while the interface remains up

    Why this is correct

    Correct. This is correct. Restrict mode drops unauthorized traffic but does not take the whole interface down. That is why the user sees a live port with no connectivity for the replacement device.

    Clue confirmation

    The clue word "best" in the question point toward this answer.

    Related concept

    Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.

  • The switch learned the new MAC address automatically and replaced the old sticky entry

    Why it's wrong here

    Sticky MAC learning does not simply replace the previous secure MAC address whenever a new device appears. The point of sticky learning is to remember approved addresses so the switch can enforce them later. When a different device appears and violates policy, the switch applies the configured violation action rather than casually overwriting the security record.

    When this WOULD be correct

    In a different scenario where the switch is configured with 'switchport port-security mac-address <new_mac>' without sticky learning, the new MAC address could replace the old one if the maximum number of secure MAC addresses has not been reached, making this option correct.

  • Port security affects only management traffic, not user traffic

    Why it's wrong here

    Port security directly affects normal user data traffic on access ports because it controls which source MAC addresses are allowed to send frames through the interface. It is not limited to management traffic.

    When this WOULD be correct

    In a scenario where a question specifies that port security is configured only for management traffic and does not impact user traffic, this option could be correct. For example, if the exam question states that a specific switch model has a unique configuration that isolates management from user traffic, then this option would apply.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Traffic from the unauthorized MAC address is being dropped while the interface remains upCorrect answer

Why this is correct

Correct. This is correct. Restrict mode drops unauthorized traffic but does not take the whole interface down. That is why the user sees a live port with no connectivity for the replacement device.

The port shut down because restrict mode always causes err-disableWrong answer — click to see why

Why this is wrong here

Restrict mode does not cause the interface to go into err-disable state; it only drops traffic from unauthorized MAC addresses while keeping the interface up. Shutdown mode would cause err-disable, but the scenario states the interface stays up/up.

★ When this WOULD be the correct answer

In a different scenario where the port security mode is set to 'shutdown' instead of 'restrict', a candidate might be asked about the behavior of the port when an unauthorized device is connected. In that case, the port would indeed go into err-disable mode, making this option correct.

Why candidates choose this

Students often confuse restrict mode with shutdown mode, assuming any violation leads to an err-disable state. The term 'restrict' might be misinterpreted as a more severe action than it actually is.

The switch learned the new MAC address automatically and replaced the old sticky entryWrong answer — click to see why

Why this is wrong here

Sticky MAC learning does not automatically replace existing secure MAC addresses with new ones; it only learns and stores the first MAC addresses seen up to the maximum limit. Once the limit is reached, any new MAC address triggers the violation action (restrict) instead of being learned.

★ When this WOULD be the correct answer

In a different scenario where the switch is configured with 'switchport port-security mac-address <new_mac>' without sticky learning, the new MAC address could replace the old one if the maximum number of secure MAC addresses has not been reached, making this option correct.

Why candidates choose this

Students may think sticky MAC dynamically adapts to any connected device, similar to dynamic MAC learning without security. They might overlook that sticky MAC enforces a fixed set of allowed addresses once learned.

Port security affects only management traffic, not user trafficWrong answer — click to see why

Why this is wrong here

Port security applies to all user data traffic on the interface, not just management traffic. It filters frames based on source MAC addresses, affecting any traffic from unauthorized devices.

★ When this WOULD be the correct answer

In a scenario where a question specifies that port security is configured only for management traffic and does not impact user traffic, this option could be correct. For example, if the exam question states that a specific switch model has a unique configuration that isolates management from user traffic, then this option would apply.

Why candidates choose this

The term 'management traffic' might be confused with control plane traffic, leading students to think port security only affects protocols like SNMP or SSH. In reality, it operates at the data plane level.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Common exam traps

Common exam trap: answer the scenario, not the keyword

A common exam trap is assuming that any port security violation immediately disables the port. Candidates often confuse 'restrict' mode with 'shutdown' mode. In 'shutdown' mode, the port goes into an error-disabled state and the interface status changes to down, but in 'restrict' mode, the port remains up and only blocks unauthorized traffic. This subtle difference can mislead test takers into selecting answers that describe the port shutting down, which contradicts the scenario where the interface stays up/up. Recognizing the behavior of each violation mode is crucial to avoid this mistake.

Trap categories for this question

  • Command / output trap

    Restrict mode is less disruptive than shutdown mode. If the configuration had used shutdown, the interface would typically go into an error-disabled state after a violation. Because the scenario says the port stays up/up, shutdown mode is not consistent with the symptoms shown.

  • Scenario analysis trap

    Restrict mode is less disruptive than shutdown mode. If the configuration had used shutdown, the interface would typically go into an error-disabled state after a violation. Because the scenario says the port stays up/up, shutdown mode is not consistent with the symptoms shown.

Detailed technical explanation

How to think about this question

Port security is a Cisco switch feature that restricts input to an interface by limiting and identifying MAC addresses of the stations allowed to access the port. It helps prevent unauthorized devices from connecting to the network by enforcing policies on which MAC addresses can send traffic through a switch port. The 'sticky' option allows the switch to dynamically learn MAC addresses and add them to the running configuration as secure addresses, which persist through reboots if saved. When port security violation mode is set to 'restrict', the switch blocks traffic from unauthorized MAC addresses but keeps the interface operational (up/up). This mode differs from 'shutdown', which disables the port entirely by placing it into an error-disabled state. The 'maximum 2' command limits the number of secure MAC addresses to two, so if a third MAC address appears, the violation action triggers. In this scenario, the unauthorized device’s frames are dropped, but the port remains physically active, explaining why the interface stays up but the device has no connectivity. A common exam trap is confusing the violation modes 'restrict' and 'shutdown'. Many assume any violation causes the port to shut down, but 'restrict' only drops unauthorized traffic and generates a log or SNMP trap without disabling the port. Understanding this distinction is critical for troubleshooting and answering exam questions correctly. Practically, restrict mode allows network administrators to monitor violations without disrupting all users on the port, providing a balance between security and availability.

KKey Concepts to Remember

  • Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.
  • The 'sticky' MAC address feature dynamically learns and saves secure MAC addresses to the running configuration for persistent security enforcement.
  • When port security violation mode is set to 'restrict', the switch blocks unauthorized MAC address traffic but keeps the interface operational and up.
  • The 'maximum' command defines how many secure MAC addresses a port can learn before triggering a violation action.
  • Violation mode 'shutdown' disables the port by placing it into an error-disabled state, unlike 'restrict' which only drops unauthorized traffic.
  • Port security directly controls user data traffic by filtering frames based on source MAC addresses, not just management traffic.
  • Sticky MAC addresses are not automatically replaced when a new unauthorized device connects; instead, the violation action is enforced.
  • Understanding the difference between violation modes is essential to correctly interpret port behavior during security violations.

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.

Real-world example

How this comes up in practice

A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.

What to study next

Got this wrong? Here's your next step.

Review port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access., then practise related 200-301 questions on the same topic to reinforce the concept.

Related practice questions

Related 200-301 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Practice this exam

Start a free 200-301 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

FAQ

Questions learners often ask

What does this 200-301 question test?

Network Services and Security — This question tests Network Services and Security — Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access..

What is the correct answer to this question?

The correct answer is: Traffic from the unauthorized MAC address is being dropped while the interface remains up — With a maximum of 1 secure MAC address, the switch learns only the company laptop's MAC via sticky learning. When the unauthorized device is plugged in, it attempts to send traffic with a new source MAC address. Since the maximum is already reached, this triggers a port security violation. In restrict mode, the switch drops frames from the violating source but leaves the interface operational, matching the observed behavior: the interface stays up/up while the unauthorized device cannot pass traffic.

What should I do if I get this 200-301 question wrong?

Review port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access., then practise related 200-301 questions on the same topic to reinforce the concept.

Are there clue words in this question I should notice?

Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Port security on Cisco switches limits the number of MAC addresses allowed on a switch port to prevent unauthorized device access.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

More 200-301 practice questions

Last reviewed: May 17, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Sign in to join the discussion.

This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.