CCNA Network Infrastructure and Connectivity Practice Question
Exhibit
interface FastEthernet0/10 switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security mac-address sticky
A switch port was configured for sticky MAC learning. Which two statements accurately describe how the feature behaves?
⚠ Common exam trap
Remember, sticky MAC learning is a feature of port security, not a replacement or a mode change.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The switch can dynamically learn MAC addresses and add them to the running configuration as secure MAC addresses.
Sticky MAC learning is Cisco’s way of letting a port learn device MAC addresses automatically, while still treating them as secure addresses under port security. In everyday language, it saves the administrator from typing each allowed MAC address by hand. As devices connect, the switch can learn their MAC addresses and place them into the running configuration as sticky secure MACs. If the administrator later saves the configuration, those learned entries can also be written into startup-config and survive a reboot. The feature does not replace port security; it works as part of port security. It also does not change the port into a trunk or disable the maximum address count. So the two correct ideas are dynamic secure learning and the ability to preserve those learned MACs by saving the configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The switch can dynamically learn MAC addresses and add them to the running configuration as secure MAC addresses.
Why this is correct
This is correct because sticky MAC learning lets the switch observe source MAC addresses arriving on the port and then record them as secure MAC entries. That gives the convenience of dynamic discovery with the control of port security.
- ✗
Sticky learning removes the need to enable port security on the interface.
Why it's wrong here
This is wrong because sticky learning is not a replacement for port security. It depends on port security already being active on the interface. Without port security, sticky learning would not function in the intended way.
When this WOULD be correct
In a different question that asks about the benefits of sticky MAC learning in a network environment where port security is already enabled, option B could be correct if it specifies that sticky learning simplifies MAC address management without needing additional configurations, assuming the context allows for a broader interpretation of 'removes the need'.
- ✓
Saved sticky addresses can become part of the startup configuration if the running configuration is saved.
Why this is correct
Sticky secure MAC addresses are first written into the running configuration as switchport port-security mac-address sticky commands when they are learned. If the administrator saves the running configuration to startup configuration, those entries become persistent and will survive a reload, so the switch will not need to re-learn them. This persistence is a key advantage of sticky learning, preventing unauthorized address changes and maintaining a consistent secure MAC table across reboots.
- ✗
Sticky learning automatically converts the interface into a trunk port.
Why it's wrong here
Sticky learning is a port security feature that affects only how MAC addresses are recorded, not the Layer 2 encapsulation mode. The interface remains in its configured switchport mode, whether access or trunk, unless the administrator explicitly changes it with commands such as switchport mode trunk. Trunk negotiation depends on DTP and the port mode, not on sticky MAC learning, so this statement is false.
When this WOULD be correct
If the question were about a feature that automatically configures a port as a trunk based on certain conditions, such as the presence of multiple VLANs or specific commands, then this option could be correct in that context.
- ✗
Sticky learning prevents the maximum secure MAC limit from being enforced.
Why it's wrong here
The maximum secure MAC address limit remains fully enforced when sticky learning is enabled; the switchport port-security maximum command still caps the number of allowed addresses. Once that limit is reached, any new source MAC address triggers a configured security violation, such as shutdown, restrict, or protect. Sticky learning merely changes how learned addresses are stored, turning them into sticky secure MAC entries, but it does not exempt the port from violation enforcement.
When this WOULD be correct
In a different scenario where the question focuses on a switch feature that allows for unlimited MAC address learning without restrictions, such as a hypothetical switch mode that ignores security limits, option E could be correct. For instance, a question could ask about a specific configuration that allows dynamic MAC learning without enforcing limits.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The switch can dynamically learn MAC addresses and add them to the running configuration as secure MAC addresses.Correct answer▾
Why this is correct
This is correct because sticky MAC learning lets the switch observe source MAC addresses arriving on the port and then record them as secure MAC entries. That gives the convenience of dynamic discovery with the control of port security.
✗Sticky learning removes the need to enable port security on the interface.Wrong answer — click to see why▾
Why this is wrong here
Sticky MAC learning is a feature of port security and cannot function without port security being enabled on the interface. The command 'switchport port-security' must be configured first, and then 'switchport port-security mac-address sticky' enables sticky learning.
★ When this WOULD be the correct answer
In a different question that asks about the benefits of sticky MAC learning in a network environment where port security is already enabled, option B could be correct if it specifies that sticky learning simplifies MAC address management without needing additional configurations, assuming the context allows for a broader interpretation of 'removes the need'.
Why candidates choose this
Students may think that sticky learning automatically secures the port without needing to enable port security, confusing it with other features like dynamic MAC address learning on a switch. However, sticky learning is a subset of port security and requires port security to be active.
✗Sticky learning automatically converts the interface into a trunk port.Wrong answer — click to see why▾
Why this is wrong here
Sticky MAC learning is a port security feature that operates on access ports and does not affect the interface's operational mode. Trunk ports are configured separately using 'switchport mode trunk' and are used for carrying multiple VLANs, which is unrelated to MAC address learning behavior.
★ When this WOULD be the correct answer
If the question were about a feature that automatically configures a port as a trunk based on certain conditions, such as the presence of multiple VLANs or specific commands, then this option could be correct in that context.
Why candidates choose this
Some students might associate 'sticky' with automatically adapting to the network, leading them to think it could change the port to trunk mode. However, sticky MAC only pertains to how MAC addresses are learned and stored, not to VLAN tagging or trunking.
✗Sticky learning prevents the maximum secure MAC limit from being enforced.Wrong answer — click to see why▾
Why this is wrong here
Sticky MAC learning does not override the maximum secure MAC address limit configured with 'switchport port-security maximum'. If the number of learned sticky addresses reaches the limit, additional MAC addresses will trigger a security violation, just like with dynamically learned addresses.
★ When this WOULD be the correct answer
In a different scenario where the question focuses on a switch feature that allows for unlimited MAC address learning without restrictions, such as a hypothetical switch mode that ignores security limits, option E could be correct. For instance, a question could ask about a specific configuration that allows dynamic MAC learning without enforcing limits.
Why candidates choose this
Students might think that because sticky addresses are saved and persistent, the switch would allow more addresses than the limit. However, the maximum limit is still enforced to prevent unauthorized devices from being learned, regardless of whether the learning is sticky or dynamic.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
IPv4 Addressing and Address Classes
Key term
MAC address
A MAC address is a unique hardware identifier assigned to a network interface card that allows devices to communicate on a local network.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.