CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: port security on a user access port limits the number of MAC addresses that can be learned or allowed on that interface to prevent unauthorized access.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
On a user access port, port security is configured with a maximum of 2 MAC addresses and violation mode restrict. A third unauthorized device is connected through a small unmanaged switch. What happens?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic from the unauthorized MAC is dropped, but the interface stays up.
In restrict mode, frames from unknown MAC addresses are dropped, the violation counter increments, and logging or SNMP traps can be generated. Unlike shutdown mode, the interface does not go err-disabled.
Key principle: Port security on a user access port limits the number of MAC addresses that can be learned or allowed on that interface to prevent unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The port goes err-disabled immediately.
Why it's wrong here
That behavior matches shutdown mode, not restrict.
When this WOULD be correct
This option would be correct in a scenario where port security is set to 'shutdown' mode instead of 'restrict'. In that case, connecting a third unauthorized device would cause the port to go into an err-disabled state immediately due to the violation of the MAC address limit.
✓
Traffic from the unauthorized MAC is dropped, but the interface stays up.
Why this is correct
That is the expected behavior in restrict mode.
Related concept
Port security on a user access port limits the number of MAC addresses that can be learned or allowed on that interface to prevent unauthorized access.
✗
The switch learns the third MAC after aging out the first one instantly.
Why it's wrong here
Aging does not occur instantly just because a new device appears.
When this WOULD be correct
In a scenario where the switch has a very short MAC address aging time configured (e.g., 1 second) and the first MAC address is disconnected, the switch could learn the third MAC address immediately after the first one ages out. This would be a valid answer if the question specified such conditions.
✗
All traffic from the port is flooded to the VLAN for analysis.
If the question specified that the port security violation mode was set to 'shutdown' or 'protect', then flooding traffic to the VLAN for analysis could be a plausible outcome, as the switch might handle the violation differently in those modes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Traffic from the unauthorized MAC is dropped, but the interface stays up.Correct answer▾
Why this is correct
That is the expected behavior in restrict mode.
✗The port goes err-disabled immediately.Wrong answer — click to see why▾
Why this is wrong here
The port goes err-disabled only when the violation mode is shutdown, not restrict. In restrict mode, the port remains up and operational.
★ When this WOULD be the correct answer
This option would be correct in a scenario where port security is set to 'shutdown' mode instead of 'restrict'. In that case, connecting a third unauthorized device would cause the port to go into an err-disabled state immediately due to the violation of the MAC address limit.
Why candidates choose this
Students often confuse restrict mode with shutdown mode because both are port security violation actions, but shutdown is more severe and causes err-disable.
✗The switch learns the third MAC after aging out the first one instantly.Wrong answer — click to see why▾
Why this is wrong here
Aging out MAC addresses is a timed process based on the configured aging time (default is 5 minutes). The switch does not instantly age out a MAC just because a new device appears; it must wait for the aging timer to expire.
★ When this WOULD be the correct answer
In a scenario where the switch has a very short MAC address aging time configured (e.g., 1 second) and the first MAC address is disconnected, the switch could learn the third MAC address immediately after the first one ages out. This would be a valid answer if the question specified such conditions.
Why candidates choose this
Some students might think that port security dynamically replaces old MACs with new ones to maintain the maximum count, but that is not how it works; aging is timer-based.
✗All traffic from the port is flooded to the VLAN for analysis.Wrong answer — click to see why▾
Why this is wrong here
Port security does not flood traffic to the VLAN for analysis. In restrict mode, only traffic from the unauthorized MAC is dropped; other traffic is forwarded normally. Flooding is unrelated to port security.
★ When this WOULD be the correct answer
If the question specified that the port security violation mode was set to 'shutdown' or 'protect', then flooding traffic to the VLAN for analysis could be a plausible outcome, as the switch might handle the violation differently in those modes.
Why candidates choose this
The term 'flooded' might remind students of unknown unicast flooding or port security violation logging, but this option describes a behavior that does not exist in port security.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
A common exam trap is confusing the restrict violation mode with shutdown mode. Candidates often mistakenly believe that any violation causes the port to go err-disabled immediately. However, restrict mode only drops unauthorized traffic and keeps the interface up, allowing legitimate devices to continue communicating. This misunderstanding can lead to selecting the wrong answer, especially when the question specifies restrict mode. Remember that shutdown mode is the one that disables the port on violation, not restrict mode. Misreading the violation mode or assuming default behavior without verification is a frequent pitfall.
Detailed technical explanation
How to think about this question
Port security is a Layer 2 feature on Cisco switches that restricts input to an interface by limiting and identifying MAC addresses of the stations allowed to access the port. It helps prevent unauthorized devices from connecting to the network by controlling which MAC addresses can send traffic through a user access port. When port security is enabled, the switch learns and stores allowed MAC addresses, either dynamically or statically, and enforces limits on the number of MAC addresses per port.
The violation mode determines the switch's response when an unauthorized MAC address is detected. In restrict mode, the switch drops traffic from unauthorized MAC addresses but keeps the interface operational. It also increments a violation counter and can generate syslog messages or SNMP traps for network monitoring. This contrasts with shutdown mode, where the port is immediately disabled (err-disabled) upon violation. The maximum MAC address limit is strictly enforced, so connecting a third device through an unmanaged switch does not allow learning beyond the configured limit.
A common exam trap is confusing restrict mode with shutdown mode. Many candidates incorrectly assume that any violation causes the port to shut down immediately. However, restrict mode is designed to maintain network availability by dropping unauthorized traffic without disabling the port. Practically, this allows network administrators to monitor violations and respond without disrupting legitimate users. Understanding this distinction is crucial for correctly answering questions about port security behavior under different violation modes.
KKey Concepts to Remember
Port security on a user access port limits the number of MAC addresses that can be learned or allowed on that interface to prevent unauthorized access.
When port security violation mode is set to restrict, the switch drops traffic from unauthorized MAC addresses but keeps the interface operational.
In restrict mode, the switch increments a violation counter and can generate syslog messages or SNMP traps for network monitoring.
Shutdown violation mode causes the port to go err-disabled immediately upon detecting an unauthorized MAC address, unlike restrict mode.
Connecting multiple devices through an unmanaged switch does not bypass the maximum MAC address limit configured on a port security-enabled interface.
Port security violation modes determine how the switch reacts to unauthorized MAC addresses, affecting network availability and security monitoring.
The switch does not instantly age out learned MAC addresses to accommodate new ones when the maximum limit is reached on a port security-enabled interface.
Understanding the difference between restrict and shutdown violation modes is essential to correctly predict port security behavior in Cisco networks.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Port security on a user access port limits the number of MAC addresses that can be learned or allowed on that interface to prevent unauthorized access.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review port security on a user access port limits the number of MAC addresses that can be learned or allowed on that interface to prevent unauthorized access., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — This question tests Network Services and Security — Port security on a user access port limits the number of MAC addresses that can be learned or allowed on that interface to prevent unauthorized access..
What is the correct answer to this question?
The correct answer is: Traffic from the unauthorized MAC is dropped, but the interface stays up. — In restrict mode, frames from unknown MAC addresses are dropped, the violation counter increments, and logging or SNMP traps can be generated. Unlike shutdown mode, the interface does not go err-disabled.
What should I do if I get this 200-301 question wrong?
Review port security on a user access port limits the number of MAC addresses that can be learned or allowed on that interface to prevent unauthorized access., then practise related 200-301 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Port security on a user access port limits the number of MAC addresses that can be learned or allowed on that interface to prevent unauthorized access.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.