A switchport should automatically disable itself if too many MAC addresses are learned beyond the configured secure limit. Which port-security violation mode causes that behavior?

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

Technical deep dive

How to think about this question

Port security is a Layer 2 security feature on Cisco switches that restricts input to an interface by limiting and identifying MAC addresses of the stations allowed to access the port. The core concept is to prevent unauthorized devices from connecting to the network by controlling which MAC addresses can send traffic through a switchport. This is essential in environments where physical access to switch ports is possible, such as in enterprise LANs. The switch learns MAC addresses dynamically or can be configured with static secure MAC addresses, and it enforces a maximum number of secure MAC addresses per port. The violation mode configured on a port determines the switch’s response when the number of learned MAC addresses exceeds the configured limit or when an unauthorized MAC address attempts to access the port. The shutdown mode is the default and most restrictive violation mode. When a violation occurs under shutdown mode, the switchport immediately transitions into an error-disabled state, effectively disabling the port and stopping all traffic. This behavior ensures a strong security posture by preventing any further unauthorized access until the port is manually re-enabled or automatically recovered via errdisable recovery mechanisms. Other modes like protect and restrict allow the port to remain operational but differ in how they handle unauthorized traffic and logging. A common exam trap is confusing the restrict and shutdown modes because both respond to violations but with different severity. Restrict mode drops unauthorized frames and logs the event but keeps the port active, which might mislead candidates into thinking it disables the port. Shutdown mode, however, disables the port entirely, which is a more visible and impactful security response. Practically, shutdown mode is used when administrators want immediate and clear notification of security violations, requiring manual intervention to restore service, thus preventing potential security breaches from continuing unnoticed.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

FAQ

Questions learners often ask