Switching and Network Access →mediumMultiple SelectObjective-mapped

CCNA Switching and Network Access Practice Question

Exhibit

Desired behavior:
- one known endpoint per port
- violation causes interface shutdown

A switch should learn one MAC address on an access port and shut the port down if a second unauthorized device appears. Which two port-security settings support that requirement?

⚠ Common exam trap

Be careful not to confuse the different port security violation modes. Only the shutdown mode will disable the port.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

switchport port-security maximum 1

Port security enforces how many MAC addresses may be learned on a port and what happens when a violation occurs. 'switchport port-security maximum 1' limits the port to one MAC address, and 'switchport port-security violation shutdown' disables the port if a violation occurs, matching the requirement. 'switchport protected' isolates ports within a switch but does not limit MAC addresses or cause a shutdown. 'switchport nonegotiate' disables DTP negotiation, which is unrelated to port security.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
switchport port-security maximum 1
Why this is correct
The 'switchport port-security maximum 1' command under interface configuration enables port security and caps the number of learned secure MAC addresses to exactly one. Once a single device's MAC address is dynamically learned and stored in the secure MAC table, any additional source MAC address seen on the port is treated as a violation, triggering the configured violation action. This is the precise command needed to satisfy the requirement of learning only one MAC address, as it directly enforces the numerical limit on secure MAC entries.
✓
switchport port-security violation shutdown
Why this is correct
The 'switchport port-security violation shutdown' command configures the port-security violation mode to 'shutdown,' which is the most severe of the three violation actions (protect, restrict, shutdown). In this mode, when a violation occurs—such as a second MAC address appearing when the maximum is set to one—the interface is immediately placed into an err-disabled (shutdown) state, dropping all traffic on that port. While this command is essential for enforcing security by disabling the port upon violation, it does not by itself set the maximum number of allowed MAC addresses; it only dictates the consequence when that maximum is exceeded.
✗
switchport protected
Why it's wrong here
The 'switchport protected' command enables the Private VLAN Edge (PVE) feature, also known as protected ports, on a Layer 2 interface. Its sole purpose is to prevent communication between protected ports on the same switch—traffic from a protected port cannot be forwarded to another protected port, though it can still reach uplink or non-protected ports. This command has no bearing on MAC address learning limits or port-security violations; it changes the forwarding domain, not the number of MAC addresses the port will learn, making it irrelevant to the requirement of restricting the switch to one learned MAC address.
When this WOULD be correct
This option would be correct in a question asking: 'Which command prevents traffic from being forwarded between ports in the same VLAN on a switch?' where the goal is to enforce port-level isolation for security.
✗
switchport nonegotiate
Why it's wrong here
The 'switchport nonegotiate' command is used on a switchport to disable Dynamic Trunking Protocol (DTP), thereby preventing the interface from negotiating trunk or access mode with its neighbor. This is commonly configured on trunk ports to stop DTP frames from being sent, but it does nothing related to port security, MAC address learning, or violation handling. Since the question is about limiting the MAC address count on an access port, this command is completely unrelated and would not achieve the desired outcome of shutting down the port after learning one MAC address.
When this WOULD be correct
This command is correct when the question asks to prevent a switch port from automatically forming a trunk with a connected device, such as when you want to ensure an access port remains an access port and avoid trunk misconfiguration.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

✓switchport port-security maximum 1Correct answer▾

Why this is correct

The 'switchport port-security maximum 1' command under interface configuration enables port security and caps the number of learned secure MAC addresses to exactly one. Once a single device's MAC address is dynamically learned and stored in the secure MAC table, any additional source MAC address seen on the port is treated as a violation, triggering the configured violation action. This is the precise command needed to satisfy the requirement of learning only one MAC address, as it directly enforces the numerical limit on secure MAC entries.

✗switchport protectedWrong answer — click to see why▾

Why this is wrong here

The 'switchport protected' command is used to isolate ports within a VLAN (private VLAN edge), preventing communication between protected ports. It does not limit MAC addresses or trigger port shutdown upon violation.

★ When this WOULD be the correct answer

This option would be correct in a question asking: 'Which command prevents traffic from being forwarded between ports in the same VLAN on a switch?' where the goal is to enforce port-level isolation for security.

Why candidates choose this

Candidates may confuse 'protected' with 'port security' because both terms relate to security features, leading them to think it limits MAC addresses or enforces violations.

✗switchport nonegotiateWrong answer — click to see why▾

Why this is wrong here

The 'switchport nonegotiate' command disables Dynamic Trunking Protocol (DTP) negotiation, preventing the port from becoming a trunk. It does not limit MAC addresses or enforce violation actions, so it cannot meet the requirement to learn one MAC and shut down on a second unauthorized device.

★ When this WOULD be the correct answer

This command is correct when the question asks to prevent a switch port from automatically forming a trunk with a connected device, such as when you want to ensure an access port remains an access port and avoid trunk misconfiguration.

Why candidates choose this

Candidates may confuse 'nonegotiate' with security features, thinking it prevents unauthorized devices by stopping negotiation, but it only affects trunking, not MAC address learning or violation actions.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Quick reference

Access Control Model Comparison

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

Go deeper

Timed practice sets

Quick scored rounds with instant marking and a written explanation per question.

Free CCNA Practice Test 2 — 30 Questions→CCNA Practice Test 3 — 25 Questions→

Study by exam domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Switching and Network Access IP Routing Network Services and Security

Filter by question format

Practise a single format at a time: PBQs, exhibits, ACLs, OSPF, drag-and-drop.

Browse scenarios

Go deeper on a topic

Each topic page collects the questions that test one concept, plus the theory behind it.

Switching and Network Access practice questions CCNA NAT practice questions Network Services and Security practice questions AI and Network Operations practice questions Network Infrastructure and Connectivity practice questions

Where to go next

CCNA 200-301 v2 exam guide Study guide All 200-301 questions

This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.