CCNA Switching and Network Access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  maximum 1 with violation shutdown

  Why this is correct

  This is the only configuration that meets the stated requirement exactly: port-security with a maximum of 1 restricts the interface to a single learned MAC address, and the shutdown violation mode immediately places the port into the err-disabled state if a second address is seen, effectively blocking all traffic on the port until an administrator manually re-enables it. Because both criteria—one learned MAC and automatic shutdown—are satisfied, this is the correct answer.

• ✗

  maximum 10 with violation protect

  Why it's wrong here

  Setting the maximum to 10 allows up to ten different MAC addresses to be learned and forwarded, which clearly violates the 'only one learned mac address' condition. Additionally, the protect violation mode, while it blocks traffic from excess MACs, does not disable the port; it silently drops the offending frames and leaves the port fully operational for the ten allowed addresses. This option is far too permissive and lacks the required shutdown action, so it is incorrect.

  When this WOULD be correct

  In a different scenario where the requirement is to allow multiple devices for redundancy, a question might ask for a configuration that permits up to 10 MAC addresses while using 'protect' mode to prevent traffic disruption. This would be suitable in environments where device changes are frequent but should not cause immediate shutdowns.

• ✗

  maximum 1 with violation restrict and no logging

  Why it's wrong here

  While maximum 1 does enforce a single learned MAC address, the restrict violation mode only discards frames with unknown source MACs while leaving the port administratively up and still passing traffic from the authorized address; it does not shut the port down as required. Moreover, suppressing logging removes the only operational record that a violation occurred, making the port silently violate the 'shut' portion of the requirement. Since the port never transitions to err-disabled, this option fails the shutdown criterion.

  When this WOULD be correct

  This option would be correct in a scenario where the requirement is to limit the number of MAC addresses to one, but the organization prefers to log the violations and continue allowing traffic from the first learned MAC address without shutting down the port.

• ✗

  maximum unlimited with violation shutdown

  Why it's wrong here

  An unlimited maximum (often implemented by setting the port-security maximum to a very high or unspecified value) effectively disables the port-security learning limit, so any number of MAC addresses can be learned without ever triggering a violation. Because the shutdown action only occurs when the configured maximum is exceeded, a violation can never happen when the limit is unlimited, meaning the port will never be shut down. This eliminates the required single-MAC restriction and renders the shutdown behavior meaningless.

  When this WOULD be correct

  In a different scenario where the requirement is to allow any number of devices to connect without restriction, and the goal is to shut down the port only after a specific security threshold is reached, option D would be appropriate. For example, a question might ask for a configuration that allows multiple devices but requires shutdown after a certain security incident.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”