CCNA Switching and Network Access Practice Question
Exhibit
show port-security interface gi1/0/10 Port Status : secure-shutdown Violation Mode : shutdown Maximum MAC Addresses : 1 Total MAC Addresses : 2
Exhibit: An access switch shows Gi1/0/10 as err-disabled shortly after an IP phone and a workstation are connected through the same wall jack. What is the most likely cause?
⚠ Common exam trap
Be cautious of assuming all err-disabled states are due to STP or VLAN issues; port security is a frequent cause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The port security maximum is too low for the connected devices
With a phone and a PC on the same access port, the switch may legitimately see two MAC addresses. Port security set to a maximum of 1 causes a violation and can place the interface into err-disabled state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The native VLAN is missing
Why it's wrong here
An incorrect or missing native VLAN on a trunk creates a spanning-tree VLAN mismatch that can disrupt traffic and cause spanning-tree errors, but it does not generate a port-security violation. Port security counts MAC addresses learned on the interface and would not shut the port down simply because the native VLAN is absent. Thus, a missing native VLAN alone cannot explain the err-disabled condition.
When this WOULD be correct
In a scenario where a switch is configured to require a native VLAN for trunking and a device attempts to connect without it, a question could ask about the impact of a missing native VLAN on trunk ports, making this option correct.
- ✓
The port security maximum is too low for the connected devices
Why this is correct
With a Cisco IP phone and a PC behind it, the switchport must learn two MAC addresses (phone and PC) on the same port. If the port-security maximum is set to 1, the second MAC address triggers a violation and the default violation mode (shutdown) places the interface into err-disabled state. The fix is to raise the maximum to at least 2 and optionally use sticky MAC addresses.
- ✗
BPDU Guard blocked the port because a workstation was attached
Why it's wrong here
BPDU Guard is designed to protect PortFast-enabled ports that should never receive BPDUs; if a BPDU arrives, the port is err-disabled. A normal workstation does not transmit BPDUs, because BPDUs are generated by switches (or spanning-tree-capable bridges). Therefore, attaching a workstation would not cause BPDU Guard to trigger; only an unauthorized switch sending BPDUs could produce that result.
When this WOULD be correct
If the question specified that a switch port was err-disabled due to receiving BPDUs from a connected device, and the context involved a misconfigured spanning tree, then option C would be correct. For example, if a switch was connected to another switch instead of an endpoint device, BPDU Guard could trigger.
- ✗
DHCP snooping denied the voice VLAN
Why it's wrong here
DHCP snooping filters DHCP messages based on trusted and untrusted ports and can drop DHCPOFFER packets from untrusted ports, but it does not place the switch interface into an err-disabled state. The err-disabled condition shown is caused by a security violation, not by DHCP packet filtering. Even if the voice VLAN IP phone failed to obtain an address, the port would remain operationally up, so this option is inconsistent with the symptom.
When this WOULD be correct
If the question described a scenario where a switch port was configured with DHCP snooping and the voice VLAN was not properly trusted, leading to the IP phone being unable to obtain an IP address, this option would be correct. In that case, the port could go err-disabled due to DHCP snooping violations.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The port security maximum is too low for the connected devicesCorrect answer▾
Why this is correct
With a Cisco IP phone and a PC behind it, the switchport must learn two MAC addresses (phone and PC) on the same port. If the port-security maximum is set to 1, the second MAC address triggers a violation and the default violation mode (shutdown) places the interface into err-disabled state. The fix is to raise the maximum to at least 2 and optionally use sticky MAC addresses.
✗The native VLAN is missingWrong answer — click to see why▾
Why this is wrong here
The native VLAN being missing would not directly cause a port to go err-disabled when connecting an IP phone and workstation; it typically results in VLAN mismatches or communication issues rather than disabling the port.
★ When this WOULD be the correct answer
In a scenario where a switch is configured to require a native VLAN for trunking and a device attempts to connect without it, a question could ask about the impact of a missing native VLAN on trunk ports, making this option correct.
Why candidates choose this
Candidates may confuse the concept of native VLANs with port security issues, leading them to believe that a missing native VLAN could cause err-disabled states due to VLAN-related misconfigurations.
✗BPDU Guard blocked the port because a workstation was attachedWrong answer — click to see why▾
Why this is wrong here
BPDU Guard is designed to protect against loops by disabling ports that receive Bridge Protocol Data Units (BPDUs). In this scenario, the port is err-disabled due to port security violations, not because of BPDU Guard activation.
★ When this WOULD be the correct answer
If the question specified that a switch port was err-disabled due to receiving BPDUs from a connected device, and the context involved a misconfigured spanning tree, then option C would be correct. For example, if a switch was connected to another switch instead of an endpoint device, BPDU Guard could trigger.
Why candidates choose this
Candidates may confuse the err-disabled state with security features like BPDU Guard, especially if they have encountered similar scenarios where misconfigurations lead to port shutdowns, leading them to select this option without fully analyzing the context.
✗DHCP snooping denied the voice VLANWrong answer — click to see why▾
Why this is wrong here
DHCP snooping denying the voice VLAN would typically result in the IP phone failing to receive an IP address, rather than causing the port to go err-disabled. The err-disabled state is more likely due to port security violations when multiple devices are connected.
★ When this WOULD be the correct answer
If the question described a scenario where a switch port was configured with DHCP snooping and the voice VLAN was not properly trusted, leading to the IP phone being unable to obtain an IP address, this option would be correct. In that case, the port could go err-disabled due to DHCP snooping violations.
Why candidates choose this
Candidates may be tempted by this option because they recognize that DHCP snooping can impact device connectivity, and they may confuse the symptoms of connectivity issues with the err-disabled state caused by port security violations.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
Err-disabled
Err-disabled is a switch port state that occurs when the switch detects a critical error on that port and automatically shuts it down to protect the network.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.