100-150 Practice Question: A network administrator is configuring a Cisco switch and wants to ensure that only the…
A network administrator is configuring a Cisco switch and wants to ensure that only the MAC addresses of known devices are allowed to send traffic on a specific access port. The administrator wants to manually specify the allowed MAC addresses and have the port shut down if a violation occurs. Which feature should be configured?
⚠ Common exam trap
Test-takers frequently confuse port security with other Layer 2 security features like DAI or DHCP snooping, which do not restrict MAC addresses on a port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port security with static MAC addresses and violation mode shutdown
Port security is the correct feature to restrict a switch port to specific MAC addresses and take action on violation. Configuring static MAC addresses and setting the violation mode to shutdown ensures that only known devices can communicate, and any violation disables the port. Other features like DAI, 802.1X, and DHCP snooping serve different security purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
802.1X authentication
Why it's wrong here
802.1X authenticates devices or users through a RADIUS server before granting access, using credentials or certificates from a supplicant, with MAC Authentication Bypass for devices without one. It is a stronger, identity-based control, but the requirement here is to list allowed MAC addresses manually on the port and shut it down on violation, which is exactly what port security with static addresses does.
- ✓
Port security with static MAC addresses and violation mode shutdown
Why this is correct
Port security allows the administrator to restrict which MAC addresses can send traffic on a port. By configuring static MAC addresses and setting the violation mode to shutdown, the port will be disabled if a frame with a different source MAC address is received. This meets the requirement of allowing only known devices and shutting down on violation.
- ✗
DHCP snooping
Why it's wrong here
DHCP snooping filters DHCP messages to prevent rogue DHCP servers. It does not control which MAC addresses can send traffic on a port. It is often used with DAI and IP Source Guard, but it does not provide the MAC address restriction and violation shutdown capability described in the scenario.
- ✗
Dynamic ARP Inspection (DAI)
Why it's wrong here
DAI validates ARP packets to prevent ARP spoofing, but it does not restrict which MAC addresses can send traffic on a port. It works with DHCP snooping to build a binding table. While it enhances security, it does not provide the port-level MAC address filtering and shutdown behavior required here.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
Courseiva writes every 100-150 question from scratch — 297 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar 100-150 questions
- Which protocol is used to provide dynamic, automatic configuration of VLANs across a domain of switches?
- What is the primary function of the 'show running-config' command on a Cisco switch?
- Which device is primarily responsible for managing traffic between different IP subnets in a corporate network?
- What is the function of the Default Gateway in an IP configuration?
- Which transmission medium is best suited for long-distance data communication with high immunity to electromagnetic inte…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 100-150 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 100-150 exam.