CCNA Network Services and Security Practice Question
A switchport is configured with sticky MAC learning and a maximum secure MAC value of 2. What is the main benefit of sticky learning in this situation?
⚠ Common exam trap
A frequent exam trap is to assume that sticky MAC learning disables the maximum secure MAC address limit or automatically converts the port into a trunk. Some candidates mistakenly believe sticky learning removes the configured maximum or disables port security after reboot. However, sticky learning only dynamically learns and locks MAC addresses up to the configured maximum and requires saving the configuration to persist. Misunderstanding this can lead to selecting incorrect answers that imply sticky learning changes port behavior beyond dynamic secure MAC address learning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It allows secure MAC addresses to be learned dynamically and used by port security.
Sticky MAC learning allows the switch to learn secure MAC addresses dynamically and treat them as port-security entries without the administrator typing them manually. In plain language, it combines some of the convenience of automatic learning with the control of port security. If the configuration is later saved, those learned entries can become persistent. This is a common CCNA port-security concept because it shows how sticky learning works with, not instead of, port security. The correct answer is the one focused on dynamic secure learning and convenience, not on disabling the maximum limit or turning the port into a trunk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It allows secure MAC addresses to be learned dynamically and used by port security.
Why this is correct
Sticky MAC learning lets the switch dynamically record MAC addresses seen on the port and save them as secure MAC addresses in the running configuration, so port security enforces these exactly like statically configured addresses. If the running configuration is saved, these sticky entries persist across reboots, keeping the port locked to the learned hosts.
- ✗
It removes the maximum secure MAC limit automatically.
Why it's wrong here
Sticky learning merely changes how secure addresses are populated; it does not alter the port-security maximum limit, which remains explicitly configured with 'switchport port-security maximum'. When the number of sticky-learned addresses reaches that maximum, new frames from other MACs are denied and the violation policy (shutdown/restrict/protect) is triggered, so the limit still enforces the address count.
When this WOULD be correct
In a different scenario where a question asks about a feature that automatically adjusts security settings based on learned MAC addresses, option B could be correct if it described a hypothetical switch configuration that dynamically increases the maximum secure MAC limit based on certain conditions, such as network load or device types.
- ✗
It converts the port into a trunk after two MAC addresses are learned.
Why it's wrong here
Sticky MAC learning only affects how MAC addresses are recorded for port security; it has no bearing on the port's Layer 2 mode. Learning two MAC addresses does not convert the port to a trunk, because trunking is controlled independently by switchport mode commands or DTP, and port security operates on the port regardless of whether it is access or trunk.
When this WOULD be correct
In a different scenario where a question asks about a switchport that is configured to automatically convert to trunking mode after a certain number of MAC addresses are learned, option C could be correct if the switch supports such functionality. For example, if the question specifies a switch model that has a feature allowing dynamic trunking based on MAC address thresholds.
- ✗
It disables port security after the first reboot.
Why it's wrong here
Sticky learning does not automatically disable port security on a reboot. If the sticky secure addresses are saved to startup-config, they are restored and remain secure after reload; if not saved, they are lost, but port security remains enabled and the switch will learn new sticky addresses dynamically. The feature is designed to preserve security, not disable it.
When this WOULD be correct
In a different exam scenario where the question states that sticky MAC learning is configured to automatically disable port security after a reboot, option D would be correct. This could be a question focused on understanding specific behaviors of port security features under certain configurations.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓It allows secure MAC addresses to be learned dynamically and used by port security.Correct answer▾
Why this is correct
Sticky MAC learning lets the switch dynamically record MAC addresses seen on the port and save them as secure MAC addresses in the running configuration, so port security enforces these exactly like statically configured addresses. If the running configuration is saved, these sticky entries persist across reboots, keeping the port locked to the learned hosts.
✗It removes the maximum secure MAC limit automatically.Wrong answer — click to see why▾
Why this is wrong here
Sticky MAC learning does not remove or override the configured maximum secure MAC limit. The maximum value of 2 still applies, and once two MAC addresses are learned, no additional addresses will be allowed.
★ When this WOULD be the correct answer
In a different scenario where a question asks about a feature that automatically adjusts security settings based on learned MAC addresses, option B could be correct if it described a hypothetical switch configuration that dynamically increases the maximum secure MAC limit based on certain conditions, such as network load or device types.
Why candidates choose this
Students might think that 'sticky' implies flexibility or that it can override limits, confusing it with other features that dynamically adjust parameters.
✗It converts the port into a trunk after two MAC addresses are learned.Wrong answer — click to see why▾
Why this is wrong here
Sticky MAC learning is a port security feature and does not affect the port's operational mode. The port remains an access port unless explicitly configured as a trunk.
★ When this WOULD be the correct answer
In a different scenario where a question asks about a switchport that is configured to automatically convert to trunking mode after a certain number of MAC addresses are learned, option C could be correct if the switch supports such functionality. For example, if the question specifies a switch model that has a feature allowing dynamic trunking based on MAC address thresholds.
Why candidates choose this
Students may confuse the concept of learning multiple MAC addresses with trunking, which allows multiple VLANs, but sticky learning does not change the port type.
✗It disables port security after the first reboot.Wrong answer — click to see why▾
Why this is wrong here
Sticky MAC addresses are saved to the running configuration and can persist across reboots if the configuration is saved to startup-config. Port security remains enabled after reboot unless explicitly disabled.
★ When this WOULD be the correct answer
In a different exam scenario where the question states that sticky MAC learning is configured to automatically disable port security after a reboot, option D would be correct. This could be a question focused on understanding specific behaviors of port security features under certain configurations.
Why candidates choose this
The term 'sticky' might be misinterpreted as temporary or non-persistent, leading to the incorrect assumption that it disables security after reboot.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
Port security
Port security is a network switch feature that restricts which devices can connect to a port based on the device's MAC address, preventing unauthorized access.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.