CCNA Switching and Network Access Practice Question
This 200-301 practice question tests your understanding of switching and network access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: port security on Cisco switches limits the number of MAC addresses learned on a switchport to prevent unauthorized access and enhance network security.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A switchport should automatically disable itself if too many MAC addresses are learned beyond the configured secure limit. Which port-security violation mode causes that behavior?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
shutdown
Shutdown is the violation mode that error-disables the port. In plain language, when the switch sees a port-security violation under shutdown mode, it reacts by taking the interface out of service rather than simply dropping frames quietly. That behavior is useful when the administrator wants a clear and strong response to unauthorized devices.
This matters because port security has several violation modes and they do not behave the same way. Restrict and protect can keep the interface up, while shutdown is the mode associated with the most visible response.
Key principle: Port security on Cisco switches limits the number of MAC addresses learned on a switchport to prevent unauthorized access and enhance network security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
shutdown
Why this is correct
This is correct because shutdown mode places the port into an error-disabled state when a violation occurs.
Related concept
Port security on Cisco switches limits the number of MAC addresses learned on a switchport to prevent unauthorized access and enhance network security.
✗
protect
Why it's wrong here
This is wrong because protect drops unauthorized traffic but does not usually error-disable the port.
When this WOULD be correct
In a different scenario, if the question asked which port-security mode allows traffic from known MAC addresses while silently dropping traffic from unknown MAC addresses without shutting down the port, 'protect' would be the correct answer.
✗
restrict
Why it's wrong here
This is wrong because restrict can log and count violations while keeping the port up.
When this WOULD be correct
In a scenario where the question asks which port-security violation mode allows traffic to continue while limiting the number of MAC addresses, 'restrict' would be the correct answer. For example, if the question specifies that the goal is to maintain network connectivity while preventing excessive MAC address learning, 'restrict' fits that requirement.
✗
dynamic
Why it's wrong here
This is wrong because dynamic is not the standard violation mode that causes error-disable behavior.
When this WOULD be correct
In a different question asking about the behavior of a switchport that learns MAC addresses dynamically and can adjust its settings based on traffic patterns, 'dynamic' could be the correct answer. For example, if the question focused on how a port can adapt to changing network conditions without manual configuration, 'dynamic' would apply.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓shutdownCorrect answer▾
Why this is correct
This is correct because shutdown mode places the port into an error-disabled state when a violation occurs.
✗protectWrong answer — click to see why▾
Why this is wrong here
The 'protect' mode does not disable the port when the secure MAC address limit is exceeded; instead, it drops packets from unknown MAC addresses without generating a notification. This behavior does not match the requirement of the question.
★ When this WOULD be the correct answer
In a different scenario, if the question asked which port-security mode allows traffic from known MAC addresses while silently dropping traffic from unknown MAC addresses without shutting down the port, 'protect' would be the correct answer.
Why candidates choose this
Candidates may choose 'protect' because they understand it limits traffic based on MAC addresses, leading them to mistakenly associate it with security measures that involve disabling the port.
✗restrictWrong answer — click to see why▾
Why this is wrong here
The 'restrict' mode allows traffic to pass but drops packets from unknown MAC addresses, without disabling the port. This does not meet the requirement of automatically disabling the port when the MAC address limit is exceeded.
★ When this WOULD be the correct answer
In a scenario where the question asks which port-security violation mode allows traffic to continue while limiting the number of MAC addresses, 'restrict' would be the correct answer. For example, if the question specifies that the goal is to maintain network connectivity while preventing excessive MAC address learning, 'restrict' fits that requirement.
Why candidates choose this
Candidates may choose 'restrict' because it sounds like a security measure that limits access, leading them to believe it could also involve disabling the port, creating confusion with the intended functionality.
✗dynamicWrong answer — click to see why▾
Why this is wrong here
The 'dynamic' option is incorrect because it does not refer to a specific port-security violation mode that disables the port when the MAC address limit is exceeded. Instead, it implies the dynamic learning of MAC addresses without enforcing a security limit.
★ When this WOULD be the correct answer
In a different question asking about the behavior of a switchport that learns MAC addresses dynamically and can adjust its settings based on traffic patterns, 'dynamic' could be the correct answer. For example, if the question focused on how a port can adapt to changing network conditions without manual configuration, 'dynamic' would apply.
Why candidates choose this
Candidates may choose 'dynamic' because it sounds like a proactive approach to managing MAC addresses, leading them to mistakenly associate it with automatic security measures rather than the specific disabling behavior required by the question.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
Be aware that not all port-security violation modes disable the port. Only Shutdown mode does this.
Detailed technical explanation
How to think about this question
Port security is a Layer 2 security feature on Cisco switches that restricts input to an interface by limiting and identifying MAC addresses of the stations allowed to access the port. The core concept is to prevent unauthorized devices from connecting to the network by controlling which MAC addresses can send traffic through a switchport. This is essential in environments where physical access to switch ports is possible, such as in enterprise LANs. The switch learns MAC addresses dynamically or can be configured with static secure MAC addresses, and it enforces a maximum number of secure MAC addresses per port.
The violation mode configured on a port determines the switch’s response when the number of learned MAC addresses exceeds the configured limit or when an unauthorized MAC address attempts to access the port. The shutdown mode is the default and most restrictive violation mode. When a violation occurs under shutdown mode, the switchport immediately transitions into an error-disabled state, effectively disabling the port and stopping all traffic. This behavior ensures a strong security posture by preventing any further unauthorized access until the port is manually re-enabled or automatically recovered via errdisable recovery mechanisms. Other modes like protect and restrict allow the port to remain operational but differ in how they handle unauthorized traffic and logging.
A common exam trap is confusing the restrict and shutdown modes because both respond to violations but with different severity. Restrict mode drops unauthorized frames and logs the event but keeps the port active, which might mislead candidates into thinking it disables the port. Shutdown mode, however, disables the port entirely, which is a more visible and impactful security response. Practically, shutdown mode is used when administrators want immediate and clear notification of security violations, requiring manual intervention to restore service, thus preventing potential security breaches from continuing unnoticed.
KKey Concepts to Remember
Port security on Cisco switches limits the number of MAC addresses learned on a switchport to prevent unauthorized access and enhance network security.
The shutdown violation mode causes the switchport to enter an error-disabled state, effectively disabling the port when the secure MAC address limit is exceeded.
The protect violation mode silently drops unauthorized frames without generating a log or disabling the port, allowing normal traffic from secure MAC addresses to continue.
The restrict violation mode drops unauthorized frames and generates a syslog message and SNMP trap but keeps the port operational.
Port security violation modes differ in severity and response, with shutdown being the most severe by disabling the port to prevent further unauthorized access.
When a port is error-disabled due to shutdown mode, manual intervention or errdisable recovery is required to re-enable the port.
Understanding port security violation modes is critical for designing secure Layer 2 access networks and responding appropriately to security breaches.
Cisco switches learn MAC addresses dynamically on access ports, and port security enforces limits to mitigate MAC flooding attacks and unauthorized device connections.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Port security on Cisco switches limits the number of MAC addresses learned on a switchport to prevent unauthorized access and enhance network security.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review port security on Cisco switches limits the number of MAC addresses learned on a switchport to prevent unauthorized access and enhance network security., then practise related 200-301 questions on the same topic to reinforce the concept.
Switching and Network Access — This question tests Switching and Network Access — Port security on Cisco switches limits the number of MAC addresses learned on a switchport to prevent unauthorized access and enhance network security..
What is the correct answer to this question?
The correct answer is: shutdown — Shutdown is the violation mode that error-disables the port. In plain language, when the switch sees a port-security violation under shutdown mode, it reacts by taking the interface out of service rather than simply dropping frames quietly. That behavior is useful when the administrator wants a clear and strong response to unauthorized devices.
This matters because port security has several violation modes and they do not behave the same way. Restrict and protect can keep the interface up, while shutdown is the mode associated with the most visible response.
What should I do if I get this 200-301 question wrong?
Review port security on Cisco switches limits the number of MAC addresses learned on a switchport to prevent unauthorized access and enhance network security., then practise related 200-301 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Port security on Cisco switches limits the number of MAC addresses learned on a switchport to prevent unauthorized access and enhance network security.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.