Question 43 of 464
N10-009 Network Security Practice Question
A network security analyst notices that a switch's CPU utilization is spiking and that the switch is flooding unicast frames to all ports. The analyst suspects a MAC address table overflow attack. Which of the following security features should be configured on the switch's access ports to mitigate this type of attack?
⚠ Common exam trap
It's easy for candidates to confuse port security with other Layer 2 security features like BPDU guard or DHCP snooping, but only port security directly limits the number of MAC addresses learned on a port to prevent CAM table overflow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port security
Port security mitigates MAC address table overflow attacks by limiting the number of MAC addresses that can be learned on an access port. When the configured limit is exceeded, the switch can take action (e.g., shutdown or restrict) to prevent an attacker from flooding the CAM table with fake source MAC addresses, which would otherwise cause the switch to fail open and flood unicast frames out all ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
BPDU guard
Why it's wrong here
BPDU guard is a Spanning Tree Protocol (STP) feature designed to protect the integrity of the STP topology on a network. It is typically configured on edge ports where no STP BPDUs (Bridge Protocol Data Units) are expected from connected devices. If a BPDU guard-enabled port receives a BPDU, it immediately puts the port into an error-disabled state, preventing unauthorized devices from influencing the STP root bridge election or creating network loops. This mechanism is unrelated to preventing MAC address table overflows caused by MAC flooding.
When this WOULD be correct
BPDU guard is correct when the question asks how to prevent a rogue switch from being connected to an access port and causing a spanning tree topology change (e.g., 'A network administrator wants to ensure that no unauthorized switches are connected to access ports. Which feature should be enabled?').
- ✓
Port security
Why this is correct
Port security is a crucial layer 2 security feature that limits the number of MAC addresses allowed to be learned on a specific switch port. By configuring a maximum MAC address limit, it directly mitigates MAC flooding attacks, which attempt to overwhelm the switch's MAC address table. If the configured limit is exceeded, the port can be set to shut down, restrict traffic, or send an alert, preventing the switch from entering a hub-like state and maintaining network integrity.
- ✗
DHCP snooping
Why it's wrong here
DHCP snooping is a security feature designed to prevent rogue DHCP servers from distributing unauthorized IP addresses and network configuration parameters to clients. It operates by building and maintaining a database of trusted DHCP information, blocking malicious DHCP responses and ensuring clients receive legitimate IP assignments. While essential for maintaining IP address integrity and preventing certain man-in-the-middle attacks, it does not address the issue of MAC address table exhaustion caused by MAC flooding attacks.
- ✗
Dynamic ARP Inspection (DAI)
Why it's wrong here
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets on a network, preventing ARP spoofing and man-in-the-middle attacks. It inspects ARP requests and responses, dropping invalid packets based on information stored in the DHCP snooping binding table, which maps IP addresses to MAC addresses. While crucial for maintaining the integrity of ARP communications and preventing IP-to-MAC address impersonation, DAI specifically targets ARP-related vulnerabilities and does not mitigate MAC address table flooding.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Port securityCorrect answer▾
Why this is correct
Port security is a crucial layer 2 security feature that limits the number of MAC addresses allowed to be learned on a specific switch port. By configuring a maximum MAC address limit, it directly mitigates MAC flooding attacks, which attempt to overwhelm the switch's MAC address table. If the configured limit is exceeded, the port can be set to shut down, restrict traffic, or send an alert, preventing the switch from entering a hub-like state and maintaining network integrity.
✗BPDU guardWrong answer — click to see why▾
Why this is wrong here
BPDU guard prevents bridge loops by disabling ports receiving BPDUs, but it does not protect against MAC address table overflow attacks, which are mitigated by limiting the number of MAC addresses learned per port via port security.
★ When this WOULD be the correct answer
BPDU guard is correct when the question asks how to prevent a rogue switch from being connected to an access port and causing a spanning tree topology change (e.g., 'A network administrator wants to ensure that no unauthorized switches are connected to access ports. Which feature should be enabled?').
Why candidates choose this
Candidates may confuse BPDU guard with port security because both are common switch security features, and the term 'guard' sounds like it could prevent attacks, leading them to incorrectly associate it with MAC flooding.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.