CCNA Switching and Network Access Practice Question
A switchport connected to a user workstation is placed in VLAN 30. The administrator also wants to prevent that port from learning more than one MAC address. Which feature should be configured?
⚠ Common exam trap
Don't confuse VLAN assignment or ACLs with port security; they serve different functions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port security
The correct feature is port security. In practical terms, port security lets the administrator control how many MAC addresses can be learned on a switchport and what happens if that limit is exceeded. That makes it a very natural fit for a user-facing access port where one endpoint is expected and unmanaged extra devices are not. This is a common access-layer hardening technique. VLAN assignment controls where the traffic belongs, but it does not limit who or what can appear on the port. Port security adds that second layer of control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Port security
Why this is correct
Port security is the correct answer because it directly restricts the number of unique MAC addresses that can be learned on a switchport, typically an access port connected to an end-user workstation. By configuring a maximum MAC address count (e.g., `switchport port-security maximum 1`) and violation modes like shutdown or restrict, it mitigates MAC flooding attacks and prevents unauthorized devices from connecting to that specific interface. This feature operates entirely at layer 2 and is designed precisely for securing user-facing switchports.
- ✗
EtherChannel
Why it's wrong here
EtherChannel is incorrect because it is a link aggregation mechanism that combines multiple physical interfaces into one logical bundle to increase throughput and provide redundancy. It operates at the data link layer and does not enforce any limit on the number of MAC addresses learned—it actually allows all MAC addresses from the connected devices to pass across the aggregated link. Configuring EtherChannel on a user workstation port would be irrelevant to port security, as it addresses bandwidth and fault tolerance, not access control or MAC address restriction.
When this WOULD be correct
If the question asked about configuring a link aggregation to increase bandwidth between switches while ensuring redundancy, then EtherChannel would be the correct answer, as it directly addresses the need for combining multiple links.
- ✗
OSPF passive-interface
Why it's wrong here
OSPF passive-interface is not applicable to switchport security because it is a routing protocol feature used to suppress OSPF hello packets and routing updates on a specific interface, typically to prevent adjacency formation on non-router links. This parameter applies only to Layer 3 routing processes and has no effect on Layer 2 switching behavior, MAC address learning, or the security of an access port connected to a workstation. It does not limit or monitor MAC addresses in any way, so it cannot fulfill the requirement described in the question.
When this WOULD be correct
If the question asked about configuring OSPF on a router and required the administrator to stop OSPF updates on a specific interface while still allowing other interfaces to participate in OSPF, then selecting OSPF passive-interface would be correct.
- ✗
Native VLAN
Why it's wrong here
The native VLAN is irrelevant because it is a characteristic of 802.1Q trunk links, where it designates the VLAN that carries untagged frames on a trunk port. While a switchport can be assigned to a VLAN, the native VLAN concept does not involve any form of MAC address restriction, port security, or access control—it merely defines the VLAN membership for untagged traffic on a trunk. A user workstation connected to an access port uses the assigned access VLAN, not the native VLAN, and the native VLAN setting provides no protection against unauthorized MAC addresses.
When this WOULD be correct
In a scenario where a question asks about configuring VLANs for trunk links and managing untagged traffic, selecting 'Native VLAN' could be correct if the question specifically addresses the need to define which VLAN untagged frames should be assigned to on a trunk port.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Port securityCorrect answer▾
Why this is correct
Port security is the correct answer because it directly restricts the number of unique MAC addresses that can be learned on a switchport, typically an access port connected to an end-user workstation. By configuring a maximum MAC address count (e.g., `switchport port-security maximum 1`) and violation modes like shutdown or restrict, it mitigates MAC flooding attacks and prevents unauthorized devices from connecting to that specific interface. This feature operates entirely at layer 2 and is designed precisely for securing user-facing switchports.
✗EtherChannelWrong answer — click to see why▾
Why this is wrong here
EtherChannel is used to aggregate multiple physical links into a single logical link for increased bandwidth and redundancy, not to limit MAC address learning on a single port. It does not provide any mechanism to restrict the number of MAC addresses learned on a switchport.
★ When this WOULD be the correct answer
If the question asked about configuring a link aggregation to increase bandwidth between switches while ensuring redundancy, then EtherChannel would be the correct answer, as it directly addresses the need for combining multiple links.
Why candidates choose this
Students might confuse EtherChannel with port security because both involve controlling traffic on switchports, but EtherChannel focuses on link aggregation rather than MAC address control.
✗OSPF passive-interfaceWrong answer — click to see why▾
Why this is wrong here
OSPF passive-interface is a routing protocol feature used to prevent OSPF from sending hello messages on an interface, typically used on interfaces that do not have OSPF neighbors. It has no effect on MAC address learning or switchport security.
★ When this WOULD be the correct answer
If the question asked about configuring OSPF on a router and required the administrator to stop OSPF updates on a specific interface while still allowing other interfaces to participate in OSPF, then selecting OSPF passive-interface would be correct.
Why candidates choose this
The term 'passive' might be misinterpreted as a security feature that limits activity on the port, leading students to incorrectly associate it with restricting MAC addresses.
✗Native VLANWrong answer — click to see why▾
Why this is wrong here
Native VLAN is a concept used on trunk ports to specify the VLAN that carries untagged traffic. It does not control MAC address learning or limit the number of MAC addresses on a switchport.
★ When this WOULD be the correct answer
In a scenario where a question asks about configuring VLANs for trunk links and managing untagged traffic, selecting 'Native VLAN' could be correct if the question specifically addresses the need to define which VLAN untagged frames should be assigned to on a trunk port.
Why candidates choose this
Students might think that native VLAN, being a VLAN-related feature, could affect MAC address learning, but it is unrelated to port security mechanisms.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
Interpreting Packet Capture Output for Layer 2/3 Troubleshooting
Key term
Access port
An access port is a switch port that connects to a single end device, like a computer or printer, and carries traffic for only one VLAN.
Key term
MAC address
A MAC address is a unique hardware identifier assigned to a network interface card that allows devices to communicate on a local network.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.