Quick Answer
The answer is maximum 1 with violation shutdown. This combination ensures the switchport learns only a single MAC address, and if any other device connects, the port immediately enters an err-disabled state, effectively shutting down to block all traffic. Port security violation shutdown mode with maximum MAC address limit works by comparing each incoming frame’s source MAC against the learned secure address; a mismatch triggers the violation action. On the CCNA 200-301 v2 exam, this scenario tests your understanding of port security’s three violation modes—shutdown, restrict, and protect—and the fact that only shutdown disables the port completely, making it the strictest option. A common trap is choosing “protect” or “restrict,” which drop or log traffic but leave the port operational, failing the requirement to shut down. Remember the mnemonic: “One MAC, one shutdown—if it’s not the one, the port is done.”
This 200-301 practice question tests your understanding of switching and network access. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: port security on Cisco switches limits the number of MAC addresses learned on a switchport to enhance network access control and prevent unauthorized devices.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A switchport should allow only one learned MAC address and shut down if a different device is connected later. Which port security violation mode and limit combination best fits that goal?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
maximum 1 with violation shutdown
This is the strict option that disables the port after a violation.
maximum 10 with violation protect
Why wrong: That is far too loose for the requirement.
maximum 1 with violation restrict and no logging
Why wrong: Restrict does not shut the port down.
maximum unlimited with violation shutdown
Why wrong: Unlimited defeats the purpose of the limit.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
maximum 1 with violation shutdown
The usual setup is maximum 1 MAC address with violation mode shutdown. That way the port is disabled when an unauthorized device appears.
Key principle: Port security on Cisco switches limits the number of MAC addresses learned on a switchport to enhance network access control and prevent unauthorized devices.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
maximum 1 with violation shutdown
Why this is correct
This is the strict option that disables the port after a violation.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Port security on Cisco switches limits the number of MAC addresses learned on a switchport to enhance network access control and prevent unauthorized devices.
maximum 10 with violation protect
Why it's wrong here
That is far too loose for the requirement.
When this WOULD be correct
In a different scenario where the requirement is to allow multiple devices for redundancy, a question might ask for a configuration that permits up to 10 MAC addresses while using 'protect' mode to prevent traffic disruption. This would be suitable in environments where device changes are frequent but should not cause immediate shutdowns.
maximum 1 with violation restrict and no logging
Why it's wrong here
Restrict does not shut the port down.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to limit the number of MAC addresses to one, but the organization prefers to log the violations and continue allowing traffic from the first learned MAC address without shutting down the port.
maximum unlimited with violation shutdown
Why it's wrong here
Unlimited defeats the purpose of the limit.
When this WOULD be correct
In a different scenario where the requirement is to allow any number of devices to connect without restriction, and the goal is to shut down the port only after a specific security threshold is reached, option D would be appropriate. For example, a question might ask for a configuration that allows multiple devices but requires shutdown after a certain security incident.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
This is the strict option that disables the port after a violation.
Why this is wrong here
The maximum limit of 10 MAC addresses is too high for the requirement of allowing only one learned MAC address. Additionally, protect mode drops frames from unknown MACs but does not shut down the port, so the port remains active even after a violation.
★ When this WOULD be the correct answer
In a different scenario where the requirement is to allow multiple devices for redundancy, a question might ask for a configuration that permits up to 10 MAC addresses while using 'protect' mode to prevent traffic disruption. This would be suitable in environments where device changes are frequent but should not cause immediate shutdowns.
Why candidates choose this
Students might confuse protect mode with shutdown mode, thinking it also disables the port. The term 'protect' sounds secure, but it only drops traffic without disabling the port.
Why this is wrong here
Restrict mode does not shut down the port; it only logs and drops frames from unknown MACs. The requirement explicitly states the port should shut down, which restrict does not achieve.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to limit the number of MAC addresses to one, but the organization prefers to log the violations and continue allowing traffic from the first learned MAC address without shutting down the port.
Why candidates choose this
Students may think restrict is a stricter action than it actually is, or they may overlook the 'no logging' part and assume restrict includes shutdown.
Why this is wrong here
Setting the maximum to unlimited defeats the purpose of limiting MAC addresses to one. Even though violation mode is shutdown, the port will never trigger a violation because there is no limit, so it will never shut down due to port security.
★ When this WOULD be the correct answer
In a different scenario where the requirement is to allow any number of devices to connect without restriction, and the goal is to shut down the port only after a specific security threshold is reached, option D would be appropriate. For example, a question might ask for a configuration that allows multiple devices but requires shutdown after a certain security incident.
Why candidates choose this
Students might focus only on the violation mode 'shutdown' and ignore the maximum limit, thinking that shutdown alone ensures the port will be disabled. However, without a limit, no violation occurs.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Be careful not to confuse the different port security violation modes. Only shutdown mode disables the port upon a violation.
Detailed technical explanation
Port security is a fundamental Layer 2 security feature on Cisco switches designed to restrict the number of MAC addresses learned on a switchport. It helps prevent unauthorized devices from connecting to the network by limiting the MAC addresses that the switch will accept on a given port. When the number of learned MAC addresses exceeds the configured limit, the switch triggers a security violation and takes a predefined action based on the violation mode configured. The violation mode 'shutdown' is the most stringent option available. When a violation occurs, the switchport immediately transitions to the error-disabled state, effectively shutting down the port and blocking all traffic. This mode is ideal when strict control is required, such as allowing only one device per port. Setting the maximum MAC address limit to 1 enforces this policy by permitting only a single device to connect. If a different device attempts to connect, the port shuts down, preventing unauthorized access. A common exam trap is confusing violation modes. Modes like 'protect' and 'restrict' do not disable the port; they only drop unauthorized frames or generate logs, which may allow unauthorized devices to connect without shutting down the port. Another pitfall is setting the maximum MAC address limit too high or unlimited, which defeats the purpose of port security. Practically, using 'maximum 1 with violation shutdown' ensures immediate response to unauthorized devices, maintaining network integrity and simplifying troubleshooting in secure environments.
Key takeaway
Port security on Cisco switches limits the number of MAC addresses learned on a switchport to enhance network access control and prevent unauthorized devices.
Real-world example
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Review port security on Cisco switches limits the number of MAC addresses learned on a switchport to enhance network access control and prevent unauthorized devices., then practise related 200-301 questions on the same topic to reinforce the concept.
Switching and Network Access — study guide chapter
Learn the concepts, then practise the questions
Switching and Network Access practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Switching and Network Access — This question tests Switching and Network Access — Port security on Cisco switches limits the number of MAC addresses learned on a switchport to enhance network access control and prevent unauthorized devices..
The correct answer is: maximum 1 with violation shutdown — The usual setup is maximum 1 MAC address with violation mode shutdown. That way the port is disabled when an unauthorized device appears.
Review port security on Cisco switches limits the number of MAC addresses learned on a switchport to enhance network access control and prevent unauthorized devices., then practise related 200-301 questions on the same topic to reinforce the concept.
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Port security on Cisco switches limits the number of MAC addresses learned on a switchport to enhance network access control and prevent unauthorized devices.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A switchport should automatically disable itself if too many MAC addresses are learned beyond the configured secure limit. Which port-security violation mode causes that behavior?
mediumWhy A: Shutdown is the violation mode that error-disables the port. In plain language, when the switch sees a port-security violation under shutdown mode, it reacts by taking the interface out of service rather than simply dropping frames quietly. That behavior is useful when the administrator wants a clear and strong response to unauthorized devices. This matters because port security has several violation modes and they do not behave the same way. Restrict and protect can keep the interface up, while shutdown is the mode associated with the most visible response.
Keep practising
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.