350-401 Security Practice Question
A network administrator is hardening a Cisco IOS switch that connects to user workstations. The security policy requires that when an unauthorized MAC address appears on an access port, the port must drop only the offending frames, generate a syslog message, and increment a counter, without shutting down the port or requiring administrative intervention. Which port security violation mode meets these requirements?
⚠ Common exam trap
Many exam-takers confuse protect with restrict, forgetting that only restrict generates syslog messages and increments the violation counter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
restrict
Port security offers three violation modes. Restrict drops unauthorized frames while sending SNMP traps, syslog messages, and incrementing the violation counter, and it leaves the port operational. Because the policy forbids err-disable and requires logging plus counters, restrict is the only mode that satisfies all conditions simultaneously.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
restrict
Why this is correct
Restrict mode drops the offending frames, sends a syslog message, and increments the violation counter, while keeping the port up. This matches every requirement: no shutdown, no admin intervention, and full auditing. It is the standard choice when visibility into violations is needed without disrupting the port.
- ✗
shutdown
Why it's wrong here
Shutdown mode places the port into an err-disabled state, which stops all traffic and requires administrative action to recover. That directly conflicts with the requirement to avoid shutdown and manual intervention. It is appropriate when strict containment is more important than availability.
- ✗
protect
Why it's wrong here
Protect mode drops offending frames but does not generate a syslog message or increment the violation counter. The security team explicitly wants notification and counter visibility, so protect mode fails the logging requirement. It is the quietest mode and is chosen when silent discarding is preferred over auditing.
- ✗
drop-and-log
Why it's wrong here
Drop-and-log is not a valid port security violation mode on Cisco IOS switches. The supported modes are protect, restrict, and shutdown. Selecting this option reflects a misunderstanding of the CLI syntax and would fail configuration, leaving the port without any intended violation handling.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.