The answer is the configuration that binds the static MAC address 001a.2b3c.4d5e to the port using `switchport port-security mac-address` and sets the violation mode to shutdown. This is correct because port security with a static MAC address explicitly authorizes only that specific server to connect, and the shutdown violation mode immediately disables the port if any unauthorized device attempts to access it, providing the strictest enforcement for a critical database server. On the Cisco DCCOR / CCNP Data Center Core 350-601 exam, this scenario tests your understanding of how to restrict switchport access in a data center environment where MAC address spoofing or unauthorized connections must be prevented. A common trap is choosing the `protect` or `restrict` violation modes, which drop or log traffic but leave the port operational, failing to meet the requirement to physically block unauthorized access. Remember the memory tip: "Static MAC plus shutdown locks the port down."
350-601 Security Practice Question
This 350-601 practice question tests your understanding of security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An engineer needs to ensure that only authorized servers can connect to a specific switch port in a data center. The port connects to a critical database server with fixed MAC address 00:1a:2b:3c:4d:5e. Which configuration is most appropriate?
Option A is correct because it explicitly binds the specific MAC address 001a.2b3c.4d5e to the port using port security, and sets the violation mode to shutdown, which disables the port if any unauthorized device attempts to connect. This ensures only the authorized database server can use the port, meeting the requirement precisely.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
switchport port-security
switchport port-security maximum 2
switchport port-security violation protect
Why it's wrong here
Allows up to two MACs, too permissive.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between specifying a static MAC address versus relying on dynamic learning with a maximum count, where candidates mistakenly think limiting to one MAC is sufficient without binding the specific authorized address.
Detailed technical explanation
How to think about this question
Port security with sticky MAC learning or static MAC binding uses the switch's MAC address table to enforce access control at Layer 2. The shutdown violation mode places the port in errdisable state, which can be recovered manually or via errdisable recovery, providing a clear security boundary. In contrast, the protect mode silently drops unauthorized traffic, which can mask security breaches and complicate troubleshooting.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security — This question tests Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: switchport port-security
switchport port-security mac-address 001a.2b3c.4d5e
switchport port-security violation shutdown — Option A is correct because it explicitly binds the specific MAC address 001a.2b3c.4d5e to the port using port security, and sets the violation mode to shutdown, which disables the port if any unauthorized device attempts to connect. This ensures only the authorized database server can use the port, meeting the requirement precisely.
What should I do if I get this 350-601 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.