Question 1,853 of 1,389
CCNA Network Services and Security Practice Question
Which two features commonly strengthen access-switch security for user-facing ports? (Choose two.)
⚠ Common exam trap
A common exam trap is selecting administrative distance or route summarization as security features for user-facing access ports. Administrative distance is a routing protocol metric used to select the best path and has no role in access-switch port security. Similarly, route summarization is a routing optimization technique that reduces routing table size but does not affect port security. Candidates may confuse these routing concepts with security features due to their importance in network design, but they do not strengthen access-switch security for user-facing ports. Recognizing this distinction is critical to avoid losing points on this question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port security
Port security can limit learned MAC addresses, and BPDU Guard can shut down an edge port that unexpectedly receives BPDUs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Port security
Why this is correct
Port security strengthens access switch security by constraining the valid source MAC addresses on an interface, typically to a learned or configured set. When a violation occurs, the switch can either drop the frame, shut down the port, or place it in a restricted state, mitigating MAC flooding and unauthorized device attachment. This feature is applied at Layer 2 on access ports, directly controlling end-station connectivity.
- ✓
BPDU Guard
Why this is correct
BPDU Guard is a Spanning Tree Protocol (STP) protection mechanism that shuts down an access port operating as a PortFast edge if it receives any BPDU. Because an end-user access port should never connect to another switch, BPDU Guard prevents accidental or malicious bridging loops and topology changes. This protects the stability of the spanning-tree domain by disabling the port, rather than allowing an unauthorized switch to participate.
- ✗
Administrative distance
Why it's wrong here
Administrative distance is a router parameter used to select the best path when multiple routing protocols offer routes to the same destination; it is not a Layer 2 or access-switch security mechanism. It operates in the control plane of routers, comparing trustworthiness of routing protocol sources, and does not inspect frames, authenticate devices, or prevent unauthorized access on a switch port. Therefore, it has no bearing on hardening access switch security.
When this WOULD be correct
If the question were about routing protocols and their configurations, asking which feature affects the selection of routes, administrative distance would be the correct answer as it helps routers choose the best path based on the trust level of the routing information.
- ✗
Route summarization
Why it's wrong here
Route summarization, also called route aggregation, reduces the size of routing tables by advertising a single, less-specific prefix that represents multiple more-specific routes. It is a scalability and convergence optimization for routing protocols like OSPF and EIGRP, not a security feature. On an access switch, route summarization cannot block frames, deter MAC spoofing, or protect spanning-tree domain, so it is unrelated to access-switch security hardening.
When this WOULD be correct
In a question focused on optimizing routing protocols and reducing routing table size, such as 'What technique can be used to minimize routing updates in a large network?', route summarization would be the correct answer as it effectively summarizes multiple routes into a single advertisement.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Port securityCorrect answer▾
Why this is correct
Port security strengthens access switch security by constraining the valid source MAC addresses on an interface, typically to a learned or configured set. When a violation occurs, the switch can either drop the frame, shut down the port, or place it in a restricted state, mitigating MAC flooding and unauthorized device attachment. This feature is applied at Layer 2 on access ports, directly controlling end-station connectivity.
✗Administrative distanceWrong answer — click to see why▾
Why this is wrong here
Administrative distance is a metric used to determine the trustworthiness of routing information from different sources, not a feature that directly enhances access-switch security for user-facing ports.
★ When this WOULD be the correct answer
If the question were about routing protocols and their configurations, asking which feature affects the selection of routes, administrative distance would be the correct answer as it helps routers choose the best path based on the trust level of the routing information.
Why candidates choose this
Candidates may confuse administrative distance with security measures, thinking that it relates to controlling access or managing user connections, leading them to mistakenly select it as a security feature.
✗Route summarizationWrong answer — click to see why▾
Why this is wrong here
Route summarization is a technique used to reduce the number of routes in a routing table, which is not directly related to securing user-facing ports on access switches. It does not enhance the security of access-switch ports where users connect their devices.
★ When this WOULD be the correct answer
In a question focused on optimizing routing protocols and reducing routing table size, such as 'What technique can be used to minimize routing updates in a large network?', route summarization would be the correct answer as it effectively summarizes multiple routes into a single advertisement.
Why candidates choose this
Candidates may confuse route summarization with network security concepts, thinking that reducing routing information could somehow relate to securing access ports, especially if they have limited understanding of specific switch security features.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.