CCNA Network Services and Security Practice Question
A switch port is configured with port-security violation mode restrict. Which two statements are true when an unauthorized MAC address appears?
⚠ Common exam trap
Do not confuse restrict with shutdown mode; restrict does not disable the port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Frames from the unauthorized MAC are dropped
Restrict drops frames from violating MAC addresses and can increment the violation counter while keeping the port up. Shutdown would err-disable the port instead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Frames from the unauthorized MAC are dropped
Why this is correct
In restrict mode, the switch filters out frames sourced from the violating MAC address while still permitting traffic from other authorized MACs. The port remains operational and continues to forward legitimate frames, but the offending source address is effectively blacklisted at the port level. This is distinct from protect mode, which silently drops, and shutdown mode, which disables the port.
- ✓
The port remains up
Why this is correct
Unlike shutdown mode, restrict does not place the interface into an err-disabled state upon a security violation. The port stays administratively up and continues to pass traffic from non-violating MAC addresses, allowing network operations to continue while the violation is logged and counted. This is a key operational difference, as it avoids manual or automatic recovery procedures.
- ✗
The interface immediately goes into err-disabled state
Why it's wrong here
Immediate err-disabling is characteristic of the shutdown violation mode, where the switch disables the port and requires manual re-enablement or a configured errdisable recovery. In restrict mode, the port does not transition to err-disabled; instead, the violating frames are dropped and counter/log entries are generated. So this option incorrectly describes restrict mode.
When this WOULD be correct
This option would be correct if the question specified port-security violation mode shutdown, where the interface immediately enters err-disabled state upon a violation.
- ✗
The switch converts the port to a trunk automatically
Why it's wrong here
Port security is a Layer 2 access security feature that governs which source MAC addresses are allowed to send frames, and it has no mechanism for automatically changing the interface's switchport mode to trunk. Trunk conversion is controlled by Dynamic Trunking Protocol (DTP) or explicit configuration, unrelated to port security violations. Therefore, the violation mode has no impact on trunking state.
When this WOULD be correct
This would be correct if the question asked about a switch feature like Dynamic Trunking Protocol (DTP) where the port automatically negotiates trunking, or if the port was configured with 'switchport mode dynamic desirable' and the connected device is a trunk-capable switch.
- ✗
The violation mode changes itself to shutdown after three attempts
Why it's wrong here
The port security violation mode is a static configuration parameter; it does not dynamically escalate or change based on the number of violations. In restrict mode, repeated violations continue to result in dropped frames and incremented counters, but the mode itself remains restrict unless an administrator manually reconfigures it. Shutdown mode would only be active if initially configured, and there is no built-in three-strike escalation.
When this WOULD be correct
This would be correct if the question specified that the port-security violation mode is shutdown and asked about the behavior after three violations. In that case, the port would enter err-disabled state after three attempts.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Frames from the unauthorized MAC are droppedCorrect answer▾
Why this is correct
In restrict mode, the switch filters out frames sourced from the violating MAC address while still permitting traffic from other authorized MACs. The port remains operational and continues to forward legitimate frames, but the offending source address is effectively blacklisted at the port level. This is distinct from protect mode, which silently drops, and shutdown mode, which disables the port.
✗The interface immediately goes into err-disabled stateWrong answer — click to see why▾
Why this is wrong here
In restrict mode, the interface does not go into err-disabled state; it stays up and drops frames from unauthorized MACs while logging the violation.
★ When this WOULD be the correct answer
This option would be correct if the question specified port-security violation mode shutdown, where the interface immediately enters err-disabled state upon a violation.
Why candidates choose this
Candidates may confuse restrict mode with shutdown mode, as both are common port-security violation actions, but only shutdown causes err-disabled.
✗The switch converts the port to a trunk automaticallyWrong answer — click to see why▾
Why this is wrong here
In port-security violation mode 'restrict', the switch does not automatically convert the port to a trunk; it only drops frames from unauthorized MACs and logs the violation.
★ When this WOULD be the correct answer
This would be correct if the question asked about a switch feature like Dynamic Trunking Protocol (DTP) where the port automatically negotiates trunking, or if the port was configured with 'switchport mode dynamic desirable' and the connected device is a trunk-capable switch.
Why candidates choose this
Candidates may confuse port-security violation actions with other switch features like trunk auto-negotiation, or mistakenly think that security violations trigger port mode changes.
✗The violation mode changes itself to shutdown after three attemptsWrong answer — click to see why▾
Why this is wrong here
In restrict mode, the switch does not change the violation mode to shutdown after any number of attempts; it simply drops frames from unauthorized MACs and logs the violation. The mode remains restrict indefinitely.
★ When this WOULD be the correct answer
This would be correct if the question specified that the port-security violation mode is shutdown and asked about the behavior after three violations. In that case, the port would enter err-disabled state after three attempts.
Why candidates choose this
Candidates may confuse restrict mode with shutdown mode, or think that restrict mode escalates to shutdown after repeated violations, similar to how some security features have a threshold-based response.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Media Access Control
Media Access Control (MAC) is a sublayer of the Data Link Layer in networking that controls how devices on the same network share access to the physical medium and uniquely identifies each device with a hardware address.
Key term
MAC address
A MAC address is a unique hardware identifier assigned to a network interface card that allows devices to communicate on a local network.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.