CCNA Network Services and Security Practice Question
Exhibit
SW1# show port-security interface gi1/0/5 Port Security : Enabled Port Status : Secure-up Violation Mode : Restrict Maximum MAC Addresses : 2 Current MAC Addresses : 2
Port security is enabled with a maximum of 2 MAC addresses, but a third device connected through a small hub causes a violation. Which result is expected in restrict mode?
⚠ Common exam trap
Be careful not to confuse restrict mode with shutdown mode, which disables the port entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Frames from the unknown MAC are dropped and the violation is counted
In restrict mode, the switch drops frames from unknown source MAC addresses and increments the violation counter, but the port stays up. That is less disruptive than shutdown mode.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The port goes immediately to err-disabled state
Why it's wrong here
Immediate err-disable is the default shutdown violation mode, which disables the port entirely and stops all traffic on it. However, the scenario describes a maximum of 2 MAC addresses with the specific behavior of dropping unknown frames while counting violations—that is restrict mode, not shutdown. Therefore, the port does not go err-disabled in this configuration; it remains operational while only the offending frames are discarded.
When this WOULD be correct
This option would be correct in a scenario where the port security is configured to place the port in err-disabled state upon a violation, such as when the violation mode is set to shutdown instead of restrict. In that case, the immediate response to a third MAC address would indeed be to disable the port.
- ✓
Frames from the unknown MAC are dropped and the violation is counted
Why this is correct
In restrict mode, the port remains in service, but any frame with a source MAC address exceeding the configured maximum of 2 is discarded, and the switch increments the port-security violation counter. This behavior matches the question's description exactly: the unknown MAC is not learned, the port is not disabled, and the violation is logged for troubleshooting. Thus, the correct action for a third MAC under a maximum of 2 is to drop the frame and count the violation.
- ✗
The switch learns the third MAC after 30 seconds automatically
Why it's wrong here
The configured maximum of 2 MAC addresses is a hard limit, so the switch will never automatically learn a third MAC address even after a timer expires. In restrict mode, frames from an unknown source MAC are dropped and the violation counter is incremented, not learned and added to the MAC table. The 30-second aging interval applies to MAC address aging in the table, but it does not reset or extend the port security maximum.
When this WOULD be correct
In a different exam scenario where the port security is set to 'sticky' learning mode, a question could state that the switch is configured to learn new MAC addresses automatically. In this case, if a third device connects, the switch would learn the MAC after the aging time expires.
- ✗
STP blocks the port until the MAC table ages out
Why it's wrong here
STP (Spanning Tree Protocol) operates to prevent Layer 2 loops by blocking redundant paths, not to enforce port security limits. A port security violation would not cause STP to block the port; STP blocking is independent of MAC address learning thresholds. Additionally, the MAC table aging out would not resolve a security violation, as restrict mode continues to drop and count violations rather than re-enabling the port after a timeout.
When this WOULD be correct
If the question specified that the port was operating in a mode where security violations lead to the port being disabled, such as protect or shutdown mode, then this option could be correct. For example, if the question stated that the port was configured to err-disable on a violation, then this answer would apply.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Frames from the unknown MAC are dropped and the violation is countedCorrect answer▾
Why this is correct
In restrict mode, the port remains in service, but any frame with a source MAC address exceeding the configured maximum of 2 is discarded, and the switch increments the port-security violation counter. This behavior matches the question's description exactly: the unknown MAC is not learned, the port is not disabled, and the violation is logged for troubleshooting. Thus, the correct action for a third MAC under a maximum of 2 is to drop the frame and count the violation.
✗The port goes immediately to err-disabled stateWrong answer — click to see why▾
Why this is wrong here
In restrict mode, the port does not go to err-disabled state; that behavior is specific to shutdown mode. Shutdown mode disables the port upon a violation, whereas restrict mode only drops traffic from unknown MACs and increments the violation counter.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the port security is configured to place the port in err-disabled state upon a violation, such as when the violation mode is set to shutdown instead of restrict. In that case, the immediate response to a third MAC address would indeed be to disable the port.
Why candidates choose this
Students often confuse restrict mode with shutdown mode because both are violation actions for port security. The term 'restrict' might be misinterpreted as a more severe action, leading to the assumption that the port is disabled.
✗The switch learns the third MAC after 30 seconds automaticallyWrong answer — click to see why▾
Why this is wrong here
Port security does not automatically learn additional MAC addresses after a delay; it strictly enforces the configured maximum number of MAC addresses. If the maximum is set to 2, any new MAC address beyond that triggers a violation action (restrict, shutdown, or protect) immediately, not after 30 seconds.
★ When this WOULD be the correct answer
In a different exam scenario where the port security is set to 'sticky' learning mode, a question could state that the switch is configured to learn new MAC addresses automatically. In this case, if a third device connects, the switch would learn the MAC after the aging time expires.
Why candidates choose this
Some students might think there is a learning period or aging mechanism that allows temporary learning of extra MACs, confusing port security with MAC address table aging or dynamic learning. However, port security violations are immediate and not delayed.
✗STP blocks the port until the MAC table ages outWrong answer — click to see why▾
Why this is wrong here
STP (Spanning Tree Protocol) is used to prevent loops in redundant topologies and does not enforce port security. Port security violations are handled by the port security feature itself, independent of STP. STP blocking a port would be unrelated to MAC address limits.
★ When this WOULD be the correct answer
If the question specified that the port was operating in a mode where security violations lead to the port being disabled, such as protect or shutdown mode, then this option could be correct. For example, if the question stated that the port was configured to err-disable on a violation, then this answer would apply.
Why candidates choose this
Students might associate STP with blocking ports and think that a violation could trigger STP to block the port. However, STP and port security are separate features; port security violations do not involve STP.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
Restrict mode
Restrict mode is a port security violation action on a managed switch that allows the port to stay active and forward traffic for authorized devices, but discards traffic from unauthorized devices while logging the violation.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.