CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  protect

  Why this is correct

  Protect is the quietest switchport port-security violation mode: when the port's MAC address table is full, it silently drops frames from new, unknown MAC addresses while continuing to forward traffic for already-learned addresses. No SNMP trap or syslog message is generated, and the port remains up and operational, making the violation virtually invisible to network monitoring. This is the correct answer because the question asks which mode drops frames without any further action or notification.

• ✗

  restrict

  Why it's wrong here

  Restrict, like protect, drops frames from unknown MAC addresses once the port's maximum secure MAC address limit is exceeded, but it also increments a violation counter and sends an SNMP trap and syslog message to alert the network administrator. The port itself remains up and continues forwarding traffic for already-learned MACs, yet the notification overhead makes it a louder enforcement than protect. Because the question asks specifically for the mode that only drops frames—without the trap/reporting behavior—restrict is not the correct choice.

  When this WOULD be correct

  In a different question, if asked about a port-security mode that drops unauthorized MAC frames but also sends alerts to network management systems, 'restrict' would be the correct answer, as it fits the criteria of notifying administrators while maintaining interface functionality.

• ✗

  shutdown

  Why it's wrong here

  Shutdown is the strictest switchport port-security violation mode: upon a violation, the port transitions to the err-disabled state, effectively shutting down all traffic on that interface until it is manually re-enabled or automatically recovered via errdisable recovery. This mode does not merely drop frames; it disables the entire port, which is a far more disruptive response than simply discarding offending frames. Since the question asks for a mode that drops frames (implying the port remains functional), shutdown is incorrect.

  When this WOULD be correct

  In a question asking for a port-security violation mode that completely disables the interface upon detecting unauthorized MAC addresses, 'shutdown' would be the correct answer. This scenario would focus on a strict security posture where any unauthorized access leads to immediate interface shutdown.

• ✗

  shutdown vlan

  Why it's wrong here

  Shutdown vlan is not a standard Cisco switchport port-security violation mode; the actual modes are protect, restrict, and shutdown. In the legacy 'shutdown vlan' behavior, the port would be administratively disabled only for the specific VLAN where the violation occurred, but this is not a configurable violation mode in modern IOS. Since this option is not one of the three canonical modes, it is incorrect for the question's context.

  When this WOULD be correct

  In a scenario where the question asks which port-security violation mode disables a specific VLAN but still allows other VLANs to function normally, 'shutdown vlan' would be the correct answer. This could involve a focus on VLAN-specific security measures rather than interface status.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”