CCNA Switching and Network Access Practice Question
Exhibit
interface GigabitEthernet0/10 switchport mode access switchport port-security switchport port-security maximum 1 switchport port-security violation shutdown Event: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC addresses ... on port Gi0/10.
After a hub was connected to interface Gi0/10, the interface immediately entered errdisable state. The following syslog message was generated: '%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred on interface Gi0/10.' What is the strongest explanation for why Gi0/10 shut down?
⚠ Common exam trap
Remember that port security specifically deals with MAC address limits, not broadcast storms or spanning-tree issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port security detected more MAC addresses than allowed on the interface.
The strongest explanation is a port-security violation caused by the switch seeing more secure MAC addresses than the interface allows. In practical terms, a hub or unmanaged device can cause multiple end hosts to appear behind one access port. If the interface is configured with a maximum of one secure MAC address, additional learned MACs trigger the violation action. This is a realistic access-layer security scenario because the port does not fail randomly. It fails because the observed behavior violates the configured policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Port security detected more MAC addresses than allowed on the interface.
Why this is correct
Port security is explicitly configured to allow only one secure MAC address, and the violation message indicates that additional MAC addresses were seen on the interface. When a hub connects, multiple end devices share that single physical port, causing the switch to detect more source MACs than the configured maximum. This triggers the port-security violation and puts the interface into an error-disabled state, matching the exhibit.
- ✗
The interface received a superior BPDU and became the root port.
Why it's wrong here
STP role changes like becoming a root port occur when a superior BPDU is received, but that event would be reflected in spanning-tree state transitions and forwarding behavior, not in a security intrusion log. A hub does not originate BPDUs, and the error message clearly identifies a port-security violation rather than an STP topology change. Therefore, the interface's down state is due to security enforcement, not a spanning-tree decision.
When this WOULD be correct
In a different question, if the scenario described involved a switch that was configured to participate in a spanning tree topology and received a superior BPDU from another switch, this option would be correct. The question would need to focus on spanning tree behavior rather than port security.
- ✗
The hub forced the interface to become a routed port.
Why it's wrong here
A hub is a Layer 1 device that simply forwards electrical signals, so it cannot change the logical mode of a switch interface. A routed port is created only by explicitly removing Layer 2 switching with the "no switchport" command, which is not shown here. The log message references a port-security violation, not a change in interface mode.
When this WOULD be correct
In a different scenario, if the question specified that the interface was configured to operate as a routed port and the hub was connected, causing a configuration change or a specific routing protocol behavior, this option could be correct. For example, if the exam asked about a network where the hub's behavior led to a routing protocol conflict, this could apply.
- ✗
DHCP snooping always shuts a port when a hub is attached.
Why it's wrong here
DHCP snooping filters DHCP messages based on whether a port is trusted or untrusted; it does not count MAC addresses or react to the simple attachment of a hub. A hub only extends the collision domain, and it does not generate DHCP traffic or cause a DHCP snooping violation by itself. The exhibit shows a port-security restriction on secure MAC addresses, not any DHCP-related action.
When this WOULD be correct
In a different question, if the scenario involved a network where DHCP snooping was explicitly configured to shut down ports upon detecting unauthorized devices, then this option could be correct. For instance, a question could describe a network with strict DHCP snooping policies and ask about the behavior of a port when a hub is connected.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Port security detected more MAC addresses than allowed on the interface.Correct answer▾
Why this is correct
Port security is explicitly configured to allow only one secure MAC address, and the violation message indicates that additional MAC addresses were seen on the interface. When a hub connects, multiple end devices share that single physical port, causing the switch to detect more source MACs than the configured maximum. This triggers the port-security violation and puts the interface into an error-disabled state, matching the exhibit.
✗The interface received a superior BPDU and became the root port.Wrong answer — click to see why▾
Why this is wrong here
The exhibit shows a port-security violation message, not an STP topology change. A superior BPDU would cause a root port election, not a port shutdown due to security policy.
★ When this WOULD be the correct answer
In a different question, if the scenario described involved a switch that was configured to participate in a spanning tree topology and received a superior BPDU from another switch, this option would be correct. The question would need to focus on spanning tree behavior rather than port security.
Why candidates choose this
Students often confuse STP events with port security because both can cause a port to change state. The term 'superior BPDU' sounds plausible for a port going down, but the actual cause is a security violation.
✗The hub forced the interface to become a routed port.Wrong answer — click to see why▾
Why this is wrong here
Connecting a hub does not change the interface type; a switchport remains a Layer 2 interface unless explicitly configured with 'no switchport'. The exhibit shows a Layer 2 security violation, not a routed port conversion.
★ When this WOULD be the correct answer
In a different scenario, if the question specified that the interface was configured to operate as a routed port and the hub was connected, causing a configuration change or a specific routing protocol behavior, this option could be correct. For example, if the exam asked about a network where the hub's behavior led to a routing protocol conflict, this could apply.
Why candidates choose this
Some students might think that hubs introduce Layer 1 issues that could force a port to become routed, but this is not a standard behavior. The concept of routed ports is often misunderstood.
✗DHCP snooping always shuts a port when a hub is attached.Wrong answer — click to see why▾
Why this is wrong here
DHCP snooping does not automatically shut down a port when a hub is attached; it filters DHCP messages and can disable ports only if a DHCP server is detected on an untrusted port. The exhibit clearly shows a port-security violation message.
★ When this WOULD be the correct answer
In a different question, if the scenario involved a network where DHCP snooping was explicitly configured to shut down ports upon detecting unauthorized devices, then this option could be correct. For instance, a question could describe a network with strict DHCP snooping policies and ask about the behavior of a port when a hub is connected.
Why candidates choose this
DHCP snooping and port security are both security features that can cause port shutdowns, leading to confusion. Students may incorrectly attribute the shutdown to DHCP snooping without reading the violation message.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
MAC address
A MAC address is a unique hardware identifier assigned to a network interface card that allows devices to communicate on a local network.
Key term
Syslog
Syslog is a standard protocol used to send and store log messages from network devices and servers to a central logging server for monitoring and troubleshooting.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.