350-601 Security Practice Question
Exhibit
``` switch# show port-security interface ethernet 1/1 Port Security : Enabled Port status : Secured Violation mode : Shutdown Maximum MAC Addresses : 1 Sticky MAC Addresses : 1 Last violation time : 00:00:15 Last violation MAC address : 000c.291a.2b3c ```
Refer to the exhibit. An administrator connects a new server to Ethernet1/1 and the port immediately goes into errdisable state. The previous device was connected to that port. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the misconception that any port security violation immediately causes errdisable, but the trap here is that only the 'shutdown' and 'restrict' modes can lead to errdisable (restrict does not errdisable but logs and drops), while 'protect' silently drops traffic without disabling the port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The new server has a different MAC address than the sticky MAC
The port immediately entering errdisable state upon connecting a new server indicates a port security violation. When port security is enabled with sticky MAC addresses, the switch dynamically learns and 'sticks' the MAC address of the first connected device to the running configuration. Connecting a device with a different MAC address triggers a security violation, and if the violation mode is 'shutdown' (the default), the port is placed into errdisable state. This matches the scenario where the previous device's MAC was learned as sticky, and the new server's MAC differs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The new server has a different MAC address than the sticky MAC
Why this is correct
Sticky MAC learned the previous server's MAC; new server's MAC is different, causing a violation and port shutdown.
- ✗
The port security violation mode is set to protect
Why it's wrong here
Protect mode drops frames but does not errdisable the port.
- ✗
The port security maximum MAC addresses is set too high
Why it's wrong here
A high maximum would allow more MACs; this violation is due to mismatch.
- ✗
The port is configured as a trunk
Why it's wrong here
Trunk configuration is not shown and would not cause this violation.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.