CCNA Network Services and Security Practice Question
Why is administratively shutting down unused switch ports considered a useful hardening practice?
⚠ Common exam trap
Do not confuse port shutdown with performance improvements or VLAN configuration changes; focus on security implications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Because it reduces attack surface by removing unused active connection points.
Unused active ports create unnecessary exposure. In practical terms, if a port is not needed, leaving it active gives someone an opportunity to connect a device where no legitimate business need exists. Shutting the port down removes that access point and reduces attack surface. This is a simple but effective hardening measure. It does not replace other controls, but it removes a risk that does not need to exist in the first place.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Because it reduces attack surface by removing unused active connection points.
Why this is correct
When a port is left enabled but unused, it remains an active connection point that an attacker could plug into, potentially gaining unauthorized network access. Administratively shutting it down places the interface in an administratively down state, which disables the link at Layer 1/2 and effectively removes that exposure. This reduces the attack surface by eliminating avoidable entry points into the network.
- ✗
Because it forces all users to manage devices with SSH.
Why it's wrong here
Disabling a switch port affects only Layer 2 link state and has no bearing on management plane protocols like SSH. SSH access is configured globally via VTY lines, transport input, and an RSA key, and applies to device management, not to the enabled/disabled status of user-facing ports. Therefore, shutting down unused ports cannot force users to adopt SSH for device management.
When this WOULD be correct
In a question asking about best practices for managing network devices, specifically focusing on access control and secure management protocols, this option could be correct if it stated that forcing users to manage devices with SSH enhances security by ensuring encrypted communication.
- ✗
Because it converts remaining ports into trunks.
Why it's wrong here
Administratively shutting a port only changes that interface's admin status to 'down'; it does not alter the switching mode (access or trunk) of any other interface. Trunking is explicitly configured per interface with commands like 'switchport mode trunk' and is used to carry multiple VLANs, not to disable ports. Thus, port shutdown has no relation to trunk conversion.
When this WOULD be correct
This option would be correct in a question that asks about configuring switch ports for specific VLANs where trunking is necessary, such as when discussing how to enable trunking on a switch after disabling unused ports to ensure only necessary connections are active.
- ✗
Because it replaces VLAN segmentation.
Why it's wrong here
Shutting down an unused port simply disables that physical link, but it does not classify or isolate traffic between VLANs. VLAN segmentation uses 802.1Q tagging and separate broadcast domains to manage traffic flow and security at Layers 2 and 3, whereas port shutdown is a binary on/off control. These are fundamentally different mechanisms: one removes connectivity, the other creates logical boundaries.
When this WOULD be correct
In a question asking about the benefits of VLAN segmentation in a network design context, option D could be correct if it states that replacing VLAN segmentation with another method is beneficial for simplifying network management or enhancing security in a specific scenario.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Because it reduces attack surface by removing unused active connection points.Correct answer▾
Why this is correct
When a port is left enabled but unused, it remains an active connection point that an attacker could plug into, potentially gaining unauthorized network access. Administratively shutting it down places the interface in an administratively down state, which disables the link at Layer 1/2 and effectively removes that exposure. This reduces the attack surface by eliminating avoidable entry points into the network.
✗Because it forces all users to manage devices with SSH.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because administratively shutting down unused switch ports does not enforce SSH for device management; it simply disables unused ports to enhance security.
★ When this WOULD be the correct answer
In a question asking about best practices for managing network devices, specifically focusing on access control and secure management protocols, this option could be correct if it stated that forcing users to manage devices with SSH enhances security by ensuring encrypted communication.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of network security practices, believing that shutting down ports directly relates to enforcing secure management protocols like SSH.
✗Because it converts remaining ports into trunks.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because administratively shutting down unused switch ports does not convert remaining ports into trunk ports; it simply disables access ports to enhance security.
★ When this WOULD be the correct answer
This option would be correct in a question that asks about configuring switch ports for specific VLANs where trunking is necessary, such as when discussing how to enable trunking on a switch after disabling unused ports to ensure only necessary connections are active.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of port configurations, thinking that disabling ports automatically leads to trunking on remaining ports, reflecting a gap in knowledge about switch port functionality.
✗Because it replaces VLAN segmentation.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because administratively shutting down unused switch ports does not directly replace VLAN segmentation; rather, it focuses on reducing the number of active ports to mitigate security risks.
★ When this WOULD be the correct answer
In a question asking about the benefits of VLAN segmentation in a network design context, option D could be correct if it states that replacing VLAN segmentation with another method is beneficial for simplifying network management or enhancing security in a specific scenario.
Why candidates choose this
Candidates may find this option tempting because they might associate the concept of shutting down ports with improving network segmentation, leading to confusion about the relationship between port management and VLANs.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
AP
An AP (Access Point) bridges wireless clients to a wired network, acting as a central transceiver and controller for Wi-Fi communications.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.