CCNA Switching and Network Access Practice Question
A switchport should automatically disable itself if too many MAC addresses are learned beyond the configured secure limit. Which port-security violation mode causes that behavior?
⚠ Common exam trap
Be aware that not all port-security violation modes disable the port. Only Shutdown mode does this.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
shutdown
Shutdown is the violation mode that error-disables the port. In plain language, when the switch sees a port-security violation under shutdown mode, it reacts by taking the interface out of service rather than simply dropping frames quietly. That behavior is useful when the administrator wants a clear and strong response to unauthorized devices. This matters because port security has several violation modes and they do not behave the same way. Restrict and protect can keep the interface up, while shutdown is the mode associated with the most visible response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
shutdown
Why this is correct
In port-security violation mode 'shutdown', the switchport is immediately placed into the error-disabled state upon a MAC address violation. This is the default and most restrictive violation mode, effectively disabling the port until an administrator manually issues the 'shutdown' and 'no shutdown' commands or the port is configured for auto-recovery via errdisable recovery. It fully blocks all traffic and generates a syslog/SNMP message.
- ✗
protect
Why it's wrong here
The protect violation mode drops all incoming frames from unauthorized MAC addresses but continues to forward traffic from known/authorized addresses. It does not error-disable the port, nor does it increment the violation counter or generate a log—it silently discards the offending frames, leaving the port operational. This is a less intrusive option for mitigating MAC flooding but provides no notification to the administrator.
When this WOULD be correct
In a different scenario, if the question asked which port-security mode allows traffic from known MAC addresses while silently dropping traffic from unknown MAC addresses without shutting down the port, 'protect' would be the correct answer.
- ✗
restrict
Why it's wrong here
The restrict violation mode also drops frames from unauthorized MAC addresses but, unlike protect, it increments the port's security violation counter and sends a syslog message (and optional SNMP trap). The port remains up and operational, forwarding valid traffic, but the counter allows administrators to monitor incident activity. Restrict does not automatically disable the port, so it is incorrect as an error-disable trigger.
When this WOULD be correct
In a scenario where the question asks which port-security violation mode allows traffic to continue while limiting the number of MAC addresses, 'restrict' would be the correct answer. For example, if the question specifies that the goal is to maintain network connectivity while preventing excessive MAC address learning, 'restrict' fits that requirement.
- ✗
dynamic
Why it's wrong here
Dynamic is not a valid port-security violation mode in Cisco IOS; the three configurable modes under the 'switchport port-security violation' command are protect, restrict, and shutdown. The term 'dynamic' is associated with dynamic port-security (sticky MAC or dynamic VLAN assignment) or the dynamic VLAN membership mode, but it does not cause error-disable behavior. Therefore, dynamic cannot be the correct answer for a port-security violation mode that shuts down the port.
When this WOULD be correct
In a different question asking about the behavior of a switchport that learns MAC addresses dynamically and can adjust its settings based on traffic patterns, 'dynamic' could be the correct answer. For example, if the question focused on how a port can adapt to changing network conditions without manual configuration, 'dynamic' would apply.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓shutdownCorrect answer▾
Why this is correct
In port-security violation mode 'shutdown', the switchport is immediately placed into the error-disabled state upon a MAC address violation. This is the default and most restrictive violation mode, effectively disabling the port until an administrator manually issues the 'shutdown' and 'no shutdown' commands or the port is configured for auto-recovery via errdisable recovery. It fully blocks all traffic and generates a syslog/SNMP message.
✗protectWrong answer — click to see why▾
Why this is wrong here
The 'protect' mode does not disable the port when the secure MAC address limit is exceeded; instead, it drops packets from unknown MAC addresses without generating a notification. This behavior does not match the requirement of the question.
★ When this WOULD be the correct answer
In a different scenario, if the question asked which port-security mode allows traffic from known MAC addresses while silently dropping traffic from unknown MAC addresses without shutting down the port, 'protect' would be the correct answer.
Why candidates choose this
Candidates may choose 'protect' because they understand it limits traffic based on MAC addresses, leading them to mistakenly associate it with security measures that involve disabling the port.
✗restrictWrong answer — click to see why▾
Why this is wrong here
The 'restrict' mode allows traffic to pass but drops packets from unknown MAC addresses, without disabling the port. This does not meet the requirement of automatically disabling the port when the MAC address limit is exceeded.
★ When this WOULD be the correct answer
In a scenario where the question asks which port-security violation mode allows traffic to continue while limiting the number of MAC addresses, 'restrict' would be the correct answer. For example, if the question specifies that the goal is to maintain network connectivity while preventing excessive MAC address learning, 'restrict' fits that requirement.
Why candidates choose this
Candidates may choose 'restrict' because it sounds like a security measure that limits access, leading them to believe it could also involve disabling the port, creating confusion with the intended functionality.
✗dynamicWrong answer — click to see why▾
Why this is wrong here
The 'dynamic' option is incorrect because it does not refer to a specific port-security violation mode that disables the port when the MAC address limit is exceeded. Instead, it implies the dynamic learning of MAC addresses without enforcing a security limit.
★ When this WOULD be the correct answer
In a different question asking about the behavior of a switchport that learns MAC addresses dynamically and can adjust its settings based on traffic patterns, 'dynamic' could be the correct answer. For example, if the question focused on how a port can adapt to changing network conditions without manual configuration, 'dynamic' would apply.
Why candidates choose this
Candidates may choose 'dynamic' because it sounds like a proactive approach to managing MAC addresses, leading them to mistakenly associate it with automatic security measures rather than the specific disabling behavior required by the question.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
Port security
Port security is a network switch feature that restricts which devices can connect to a port based on the device's MAC address, preventing unauthorized access.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.