CCNA Switching and Network Access Practice Question
A switchport is configured as an access port in VLAN 10, but a user plugs in a small unmanaged switch and connects multiple devices behind it. Which security feature most directly limits that behavior at the switchport?
⚠ Common exam trap
A frequent exam trap is assuming that VLAN assignment alone restricts the number of devices behind a switchport. VLANs only segregate traffic logically and do not prevent multiple MAC addresses from appearing on a port. Another common mistake is selecting unrelated options like OSPF authentication, which secures routing protocol exchanges but does not control Layer 2 access. NetFlow and NTP are also unrelated to limiting connected devices. The key is recognizing that only port security directly limits how many MAC addresses can be learned on a port, thus controlling the number of connected devices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port security
Port security most directly limits that behavior because it can restrict how many MAC addresses are learned on the switchport. In practical terms, if the interface is supposed to support one endpoint but suddenly begins presenting multiple MAC addresses from a downstream mini-switch, port security can detect and react to that change. This is a classic access-layer control question. VLAN assignment alone does not limit how many devices appear behind the port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Port security
Why this is correct
Port security is the correct answer because it operates directly at the switchport to restrict the number of and identity of MAC addresses allowed to send traffic. On an access port in VLAN 10, you can configure a maximum MAC address count and define allowed MACs, triggering protection actions like shutdown or restrict when a violation occurs. This functionality precisely limits endpoint behavior and secures the access layer.
- ✗
OSPF authentication
Why it's wrong here
OSPF authentication is a Layer 3 routing protocol feature that validates neighbor relationships by encrypting or hashing OSPF packets between routers. It does not inspect or control traffic from end hosts on a switchport, nor does it regulate MAC addresses. Since OSPF is concerned with route exchange in the control plane, it cannot enforce any policy on the data plane of an access port.
When this WOULD be correct
In a scenario where the question asks about securing OSPF routing updates in a network with multiple routers, and the focus is on preventing unauthorized routing information from being exchanged, OSPF authentication would be the correct answer. This would involve configuring authentication methods to ensure only trusted routers can participate in OSPF.
- ✗
NetFlow
Why it's wrong here
NetFlow is a traffic monitoring technology that samples and exports metadata about IP flows, such as source and destination addresses, ports, and byte counts. It provides visibility into traffic patterns but lacks any enforcement capability to block or limit which MAC addresses can use an access port. Therefore, while NetFlow could observe activity on a VLAN 10 port, it cannot directly control endpoint access or enforce security limits.
When this WOULD be correct
If the exam question asked about monitoring traffic patterns and analyzing bandwidth usage on a switchport, NetFlow would be the correct answer. For example, a question could present a scenario where a network administrator needs to track the flow of data through a specific VLAN to identify performance issues.
- ✗
NTP
Why it's wrong here
NTP is a protocol designed to synchronize clocks across network devices, ensuring consistent timestamps for logging and authentication. It has no mechanism to filter, block, or limit endpoints on a Layer 2 access port. Even if NTP were enabled on the switch, it would not prevent a host in VLAN 10 from sending traffic, making it wholly unrelated to port-level access control.
When this WOULD be correct
In a question focused on time synchronization issues in a network, where the exam asks about ensuring accurate time across devices in a networked environment, NTP would be the correct answer. For example, if a question asks which protocol ensures that all devices have synchronized time to prevent logging discrepancies, NTP would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Port securityCorrect answer▾
Why this is correct
Port security is the correct answer because it operates directly at the switchport to restrict the number of and identity of MAC addresses allowed to send traffic. On an access port in VLAN 10, you can configure a maximum MAC address count and define allowed MACs, triggering protection actions like shutdown or restrict when a violation occurs. This functionality precisely limits endpoint behavior and secures the access layer.
✗OSPF authenticationWrong answer — click to see why▾
Why this is wrong here
OSPF authentication is a routing protocol security feature used to authenticate OSPF neighbor messages, not to control endpoint behavior on a switchport. It has no effect on limiting the number of devices connected to a port.
★ When this WOULD be the correct answer
In a scenario where the question asks about securing OSPF routing updates in a network with multiple routers, and the focus is on preventing unauthorized routing information from being exchanged, OSPF authentication would be the correct answer. This would involve configuring authentication methods to ensure only trusted routers can participate in OSPF.
Why candidates choose this
Students might confuse authentication with general security and think it could prevent unauthorized devices, but OSPF authentication only secures routing updates, not access-layer connectivity.
✗NetFlowWrong answer — click to see why▾
Why this is wrong here
NetFlow is a traffic monitoring and analysis tool that provides visibility into network flows, but it does not enforce any limits on the number of MAC addresses or devices on a switchport. It is used for accounting and troubleshooting, not access control.
★ When this WOULD be the correct answer
If the exam question asked about monitoring traffic patterns and analyzing bandwidth usage on a switchport, NetFlow would be the correct answer. For example, a question could present a scenario where a network administrator needs to track the flow of data through a specific VLAN to identify performance issues.
Why candidates choose this
Because NetFlow can detect unusual traffic patterns, a student might think it could detect or limit multiple devices, but it lacks enforcement capabilities and operates at a higher layer.
✗NTPWrong answer — click to see why▾
Why this is wrong here
NTP (Network Time Protocol) is used for clock synchronization across network devices and has no mechanism to limit the number of endpoints connected to a switchport. It is unrelated to port-level security.
★ When this WOULD be the correct answer
In a question focused on time synchronization issues in a network, where the exam asks about ensuring accurate time across devices in a networked environment, NTP would be the correct answer. For example, if a question asks which protocol ensures that all devices have synchronized time to prevent logging discrepancies, NTP would be appropriate.
Why candidates choose this
Students might mistakenly think NTP can be used for logging or time-based access control, but it only provides time synchronization, not security enforcement.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.