CCNA Network Services and Security Practice Question
Why is shutting down unused switch ports considered a useful hardening measure?
⚠ Common exam trap
Don't confuse port security measures with performance improvements or unrelated security features like VLAN isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Because it removes unused active connection points and reduces attack surface.
Shutting down unused switch ports reduces attack surface by removing unnecessary active connection points. This is a simple but effective control because it eliminates the risk of unauthorized physical access. Option B is incorrect because disabling a port does not change its mode to trunk; trunking is a separate configuration. Option C is incorrect because shutting down ports does not replace VLAN segmentation; VLANs provide logical separation, while port shutdown is a physical access control. Option D is incorrect because shutting down ports does not force devices to use SSH; SSH is an application-layer protocol for secure remote management, unrelated to port shutdown.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Because it removes unused active connection points and reduces attack surface.
Why this is correct
This is correct because unused enabled ports are avoidable exposure points.
- ✗
Because it converts all other ports into trunks.
Why it's wrong here
Shutting down unused ports does not convert other ports into trunks; that function is performed by the `switchport mode trunk` command, which manually enables trunking on a specific interface. This option is tempting because disabling a port and configuring a trunk both involve interface-level commands, and a novice might confuse the security goal of port shutdown with the connectivity goal of trunk establishment. The correct hardening measure is to administratively disable unused ports to prevent unauthorised device attachment, not to alter the VLAN tagging behaviour of operational ports.
When this WOULD be correct
In a question asking about the effects of configuring switch ports, if it specifically states that all ports are being converted to trunk ports for the purpose of allowing multiple VLANs, then this option could be correct. For example, 'What happens when all switch ports are configured to trunk mode?' would make this option valid.
- ✗
Because it replaces VLAN segmentation.
Why it's wrong here
This is wrong because port shutdown and VLAN design solve different problems.
When this WOULD be correct
This option could be correct in a question that asks about the benefits of VLANs in network design, specifically focusing on how VLANs can replace the need for physical segmentation of networks. In that context, one might argue that VLANs can provide similar security benefits by isolating traffic.
- ✗
Because it forces devices to use SSH.
Why it's wrong here
This is wrong because unused-port shutdown does not enforce management protocols.
When this WOULD be correct
In a different question asking about methods to enforce secure management protocols on network devices, the option could be correct if the context involves configuring devices to require SSH for remote access, thereby improving security.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Because it removes unused active connection points and reduces attack surface.Correct answer▾
Why this is correct
This is correct because unused enabled ports are avoidable exposure points.
✗Because it converts all other ports into trunks.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because shutting down unused switch ports does not convert other ports into trunk ports; trunking is a separate configuration that allows multiple VLANs to traverse a single port.
★ When this WOULD be the correct answer
In a question asking about the effects of configuring switch ports, if it specifically states that all ports are being converted to trunk ports for the purpose of allowing multiple VLANs, then this option could be correct. For example, 'What happens when all switch ports are configured to trunk mode?' would make this option valid.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of switch port configurations, where they confuse the act of shutting down ports with the concept of trunking, leading them to think that shutting down ports somehow affects the configuration of other ports.
✗Because it replaces VLAN segmentation.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because shutting down unused switch ports does not replace VLAN segmentation; rather, it complements it by securing unused ports. VLAN segmentation is a separate network design strategy that isolates traffic within the same network.
★ When this WOULD be the correct answer
This option could be correct in a question that asks about the benefits of VLANs in network design, specifically focusing on how VLANs can replace the need for physical segmentation of networks. In that context, one might argue that VLANs can provide similar security benefits by isolating traffic.
Why candidates choose this
Candidates may find this option tempting because they understand that VLANs are a key component of network security and may mistakenly believe that shutting down ports directly relates to enhancing VLAN functionality.
✗Because it forces devices to use SSH.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because shutting down unused switch ports does not enforce the use of SSH for device management; it simply reduces the number of active ports available for potential unauthorized access.
★ When this WOULD be the correct answer
In a different question asking about methods to enforce secure management protocols on network devices, the option could be correct if the context involves configuring devices to require SSH for remote access, thereby improving security.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of security practices, conflating port management with secure communication protocols, leading them to believe that shutting down ports inherently enforces SSH usage.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
VLAN
A VLAN logically segments a physical network into isolated broadcast domains without requiring separate physical switches.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.