CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The port immediately goes err-disabled.

  Why it's wrong here

  Setting the port-security violation mode to shutdown causes the interface to immediately transition to the err-disabled state when any unauthorized frame is received, effectively blocking all traffic on that port. This is a much more drastic action than the restrict mode described in the correct answer, and it typically requires manual re-enabling or an errdisable recovery policy. Because the stem specifies restrict behavior, the port does not go err-disabled.

  When this WOULD be correct

  If the question specified a command that sets the violation mode to 'shutdown' instead of 'restrict', then the correct answer would be that the port goes err-disabled upon detecting a second unauthorized MAC address. This would align with the behavior of the shutdown mode.

• ✓

  Frames from the unauthorized MAC are dropped and the violation is counted while the port stays up.

  Why this is correct

  In port-security restrict mode, frames from an unauthorized MAC address are silently discarded at the ingress port, and the port's security violation counter is incremented to record the event. Crucially, the access port remains operationally up and continues to forward traffic from all authorized MACs, so normal connectivity is not interrupted. This behavior distinguishes restrict from shutdown (which err-disables the port) and protect (which drops but does not increment the counter).

• ✗

  The switch forwards the traffic but logs a warning.

  Why it's wrong here

  Port-security is designed to enforce a strict MAC allowlist; when an unauthorized MAC attempts to send traffic, the switch does not forward that traffic under any violation mode. In restrict mode the frames are dropped, and although a syslog message may be generated, forwarding the offending traffic would defeat the security purpose. The only actions defined by port-security are restrict (drop and count), protect (drop silently), and shutdown (err-disable), none of which permit forwarding the violating frames.

  When this WOULD be correct

  If the question stated that the command used was 'switchport port-security violation protect', then this option would be correct, as it allows the switch to forward traffic from authorized MAC addresses while dropping frames from unauthorized ones without disabling the port.

• ✗

  The port transitions to listening and learning states.

  Why it's wrong here

  The listening and learning states are part of the Spanning Tree Protocol (STP) state machine, used during Layer 2 topology convergence to determine the active loop-free path. Port-security violation handling has no relationship to STP states; it is a separate feature that either drops frames, increments a counter, or shuts down the port. Therefore, a violation never causes the interface to transition into listening or learning states.

  When this WOULD be correct

  In a different scenario where the question asks about a switchport configured with 'switchport port-security violation shutdown', the port would indeed transition to err-disabled, but if it were a question about a port security feature that allows learning of new MACs, this option could be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”