350-601 Security Practice Question
An engineer needs to implement port security on a Cisco Nexus 1000v virtual switch to prevent MAC flooding attacks. The requirement is to allow only the first MAC address learned on the port. Which command sequence accomplishes this?
⚠ Common exam trap
Cisco often tests the distinction between 'violation protect' (silently drops unknown traffic) and 'violation shutdown' (disables the port), and candidates may mistakenly choose 'protect' thinking it is sufficient, but only 'shutdown' fully prevents MAC flooding by stopping all traffic on the port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
interface ethernet 1/1 switchport port-security switchport port-security maximum 1 switchport port-security violation shutdown
The command sequence sets the maximum number of MAC addresses to 1, which ensures only the first learned MAC address is allowed on the port. The 'violation shutdown' action disables the port if a violation occurs, effectively preventing MAC flooding attacks by stopping any additional MAC addresses from being learned.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
interface ethernet 1/1 switchport port-security switchport port-security maximum 2 switchport port-security violation restrict
Why it's wrong here
Maximum 2 allows two MACs; restrict drops but does not shut.
- ✓
interface ethernet 1/1 switchport port-security switchport port-security maximum 1 switchport port-security violation shutdown
Why this is correct
This sets the maximum MAC addresses to 1 and violation action to shutdown.
- ✗
interface ethernet 1/1 switchport port-security switchport port-security maximum 10 switchport port-security violation protect
Why it's wrong here
Maximum 10 allows ten; protect drops but does not shut.
- ✗
interface ethernet 1/1 switchport port-security manual switchport port-security mac-address 0000.1111.2222
Why it's wrong here
'port-security manual' is not a valid NX-OS command.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.