CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  It reduces the attack surface by removing unnecessary network entry points.

  Why this is correct

  An unused enabled switchport is a potential access point for unauthorized devices, allowing threats such as ARP spoofing, DHCP starvation, or rogue access points. Administratively shutting it down disables the physical layer, preventing any frames from entering or leaving that interface and eliminating this entry vector. This is a fundamental network-hardening practice that reduces the attack surface without affecting other ports.

• ✗

  It increases available bandwidth on the switch backplane.

  Why it's wrong here

  The switch backplane bandwidth is a fixed hardware capacity determined by the internal switching fabric (e.g., the sum of all ports' line-rate forwarding capability). Administratively disabling unused ports does not increase or change this aggregate throughput; it only removes those interfaces from the forwarding path. Even with fewer active interfaces, the backplane will still operate at its designed maximum capacity, so no bandwidth gain occurs.

  When this WOULD be correct

  In a question focused on optimizing network performance, such as 'What actions can improve the overall bandwidth efficiency of a switch?', this option could be correct if it specifies that shutting down unused ports can help allocate resources more effectively by reducing unnecessary traffic on the switch.

• ✗

  It enables 802.1Q trunking on all remaining ports.

  Why it's wrong here

  802.1Q trunking is configured per interface using commands such as switchport mode trunk or via DTP negotiation, and it is unaffected by the administrative state of other ports. Shutting down a port merely sets its administrative status to 'down' at Layer 1, which does not alter the interface mode or the trunking configuration of remaining ports. Therefore, disabling unused interfaces has no relationship with the encapsulation or VLAN tagging behavior on other ports.

  When this WOULD be correct

  In a question focused on VLAN configuration, where the context is about optimizing trunking capabilities across a switch, stating that enabling 802.1Q trunking on all remaining ports is correct could be valid. For example, if the question asks how to ensure that all active ports can handle multiple VLANs efficiently, this option could be correct.

• ✗

  It forces port security to activate automatically.

  Why it's wrong here

  Port security is a feature that must be explicitly configured per interface with the switchport port-security command, along with the desired violation mode and MAC address limits. Issuing the shutdown command does not enable this feature; it only places the interface in a down state. While the default violation mode for port security is 'shutdown,' that is a separate reaction to a security violation and not a result of manually shutting down the port. Thus, an administrative shutdown cannot trigger or force port security activation.

  When this WOULD be correct

  In a question asking about the benefits of enabling port security on a switch, one might state that shutting down unused ports can help ensure that port security is enforced on active ports, as it reduces the risk of unauthorized access through unused ports.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”