Match each Layer 2 protection feature to its most accurate purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Limits and controls MAC address use on a switch port
Disables an edge port if a BPDU is received
Helps block rogue DHCP activity and build trusted bindings
Validates ARP traffic using trusted information
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Storm Control: Limits excessive broadcast, multicast, or unicast traffic to prevent network storms.
Storm Control limits excessive traffic. Port Security limits MAC addresses. DHCP Snooping blocks unauthorized DHCP servers. DAI validates ARP packets. IP Source Guard filters IP traffic based on DHCP snooping. 802.1X authenticates devices before granting access.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Storm Control: Limits excessive broadcast, multicast, or unicast traffic to prevent network storms.
Why this is correct
Storm Control operates on a switch port by tracking the ingress rate of broadcast, multicast, or unicast frames and comparing it against a user-defined rising threshold. When the traffic rate exceeds that threshold, the switch drops excess frames or optionally disables the port until a falling threshold is reached. This prevents broadcast storms from consuming excessive bandwidth and CPU resources, thereby maintaining network stability. As a result, Storm Control directly limits excessive traffic of these types, making this the correct description.
Storm Control: Authenticates devices before granting network access.
Why it's wrong here
Storm Control is a Layer 2 rate-limiting mechanism that monitors the amount of broadcast, multicast, or unicast traffic on a port and drops frames when a configured threshold is exceeded. It has no role in verifying the identity of connected devices or authorizing network access. Device authentication before granting access is accomplished by 802.1X, which uses EAP and a RADIUS server to validate credentials. Therefore, the statement is incorrect because it confuses traffic policing with access control.
When this WOULD be correct
If the question asked 'Which feature authenticates devices before granting network access?' or 'Match each security feature to its purpose: 802.1X — Authenticates devices before granting network access.'
Storm Control: Validates ARP packets to prevent ARP spoofing attacks.
Why it's wrong here
Storm Control does not perform packet-level inspection of ARP frames, and it does not validate the relationship between IP addresses and MAC addresses. It simply counts the number of broadcast, multicast, or unicast frames and enforces rate limits, without understanding the protocol semantics. The validation of ARP packets to block ARP spoofing is performed by Dynamic ARP Inspection (DAI), which checks ARP packets against the DHCP snooping binding database. Therefore, this option misidentifies DAI's purpose as Storm Control's function.
When this WOULD be correct
In a question asking 'Which feature validates ARP packets to prevent ARP spoofing attacks?', the correct answer would be Dynamic ARP Inspection (DAI), not Storm Control.
Storm Control: Filters IP traffic based on DHCP snooping bindings.
Why it's wrong here
Storm Control does not inspect the contents or source of IP packets, nor does it reference any DHCP snooping binding table. Instead, it is a purely statistical, rate-based feature that measures the amount of traffic on a port and applies global or per-type thresholds. Filtering IP traffic based on DHCP snooping bindings is the function of IP Source Guard, which validates the source IP and MAC address against the DHCP snooping database. Hence, this statement inaccurately assigns IP Source Guard's behavior to Storm Control.
When this WOULD be correct
In a question asking 'Match each security feature to its purpose,' where the options include 'DHCP Snooping: Filters IP traffic based on DHCP snooping bindings' and 'Storm Control: Limits excessive traffic,' this option would be wrong. However, if the question were 'Which feature filters IP traffic based on DHCP snooping bindings?' the correct answer would be 'IP Source Guard,' not Storm Control.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
Storm Control operates on a switch port by tracking the ingress rate of broadcast, multicast, or unicast frames and comparing it against a user-defined rising threshold. When the traffic rate exceeds that threshold, the switch drops excess frames or optionally disables the port until a falling threshold is reached. This prevents broadcast storms from consuming excessive bandwidth and CPU resources, thereby maintaining network stability. As a result, Storm Control directly limits excessive traffic of these types, making this the correct description.
Why this is wrong here
Storm Control does not authenticate devices; it limits traffic rates. Device authentication is handled by 802.1X or port security, not storm control.
★ When this WOULD be the correct answer
If the question asked 'Which feature authenticates devices before granting network access?' or 'Match each security feature to its purpose: 802.1X — Authenticates devices before granting network access.'
Why candidates choose this
Candidates may confuse storm control with other security features like port security or 802.1X, assuming all Layer 2 protections involve authentication.
Why this is wrong here
Storm Control does not validate ARP packets; that is the function of Dynamic ARP Inspection (DAI). Storm Control limits traffic rates to prevent storms.
★ When this WOULD be the correct answer
In a question asking 'Which feature validates ARP packets to prevent ARP spoofing attacks?', the correct answer would be Dynamic ARP Inspection (DAI), not Storm Control.
Why candidates choose this
Candidates may confuse Storm Control with security features like DAI because both deal with controlling traffic, but they serve different purposes.
Why this is wrong here
Storm Control does not filter IP traffic based on DHCP snooping bindings; that is the function of Dynamic ARP Inspection (DAI) or IP Source Guard.
★ When this WOULD be the correct answer
In a question asking 'Match each security feature to its purpose,' where the options include 'DHCP Snooping: Filters IP traffic based on DHCP snooping bindings' and 'Storm Control: Limits excessive traffic,' this option would be wrong. However, if the question were 'Which feature filters IP traffic based on DHCP snooping bindings?' the correct answer would be 'IP Source Guard,' not Storm Control.
Why candidates choose this
Candidates may confuse Storm Control with other security features like DHCP Snooping or IP Source Guard, especially when they all deal with traffic filtering and storm prevention concepts.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Learn chapter
Interpreting Packet Capture Output for Layer 2/3 Troubleshooting
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
Extensible Authentication Protocol
Extensible Authentication Protocol (EAP) is a flexible authentication framework used in network access control, particularly in wireless and point-to-point connections, that supports multiple authentication methods without requiring changes to the underlying protocol.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.