Match the security feature to its main purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Filters traffic based on defined permit and deny rules
Helps block rogue DHCP servers and build trusted binding information
Validates ARP traffic against trusted information to reduce ARP spoofing
Limits and controls MAC addresses learned on a switch port
⚠ Common exam trap
Avoid confusing the general term 'security' with specific functions. Firewalls filter traffic; they do not encrypt, detect endpoint malware, or provide centralized log analysis. Each security tool has a defined purpose.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Firewall: Filters traffic based on security rules
ACLs are correct because they use permit and deny statements to filter traffic based on source/destination IP, protocol, or port. DHCP Snooping is correct because it identifies trusted ports and builds a DHCP binding table to block rogue DHCP servers and prevent spoofed DHCP messages. DAI is correct because it leverages the DHCP Snooping binding table to validate ARP packets, dropping those that do not match trusted bindings and thus preventing ARP spoofing attacks. Port Security is correct because it restricts the number and specific MAC addresses learned on a switch port, mitigating MAC flooding and unauthorized device access.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Firewall: Filters traffic based on security rules
Why this is correct
Firewalls inspect packets and apply rules to permit or deny traffic, forming the first line of defense in network security.
Intrusion Prevention System: Detects and blocks malicious activity
Why this is correct
Firewalls do not encrypt data; encryption is performed by VPNs or encryption protocols like IPsec.
VPN: Encrypts data between remote sites
Why this is correct
Endpoint malware detection is the role of antivirus software, not a firewall.
Access Control List: Permits or denies traffic based on IP/port
Why this is correct
Centralized log analysis is the function of a SIEM system, not a firewall.
Visual reference
Quick reference
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Learn chapter
ARP — Address Resolution Protocol
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.