Port Security: MAC Address Limiting
A network administrator wants to ensure that only authorized devices can access the network on a switch port. The administrator has a list of allowed MAC addresses. Which security feature should be enabled on the switch port?
Quick Answer
Port security is the correct choice because it enables MAC address limiting on a switch port, allowing the administrator to define a specific list of allowed MAC addresses and restrict access to only those devices. When a device with an unauthorized MAC address attempts to connect, the switch can either block the traffic, generate an alert, or place the port into an errdisable state, enforcing strict access control at the data link layer. On the CompTIA Network+ N10-009 exam, this concept tests your understanding of Layer 2 security features, often appearing in scenario-based questions where you must choose between port security, 802.1X, or DHCP snooping. A common trap is confusing port security with MAC filtering on a wireless network—remember that port security is a switch-port feature, not a wireless one. To recall the three violation modes, think of the mnemonic “S.P.A.”: Shutdown (errdisable), Protect (drops unknown frames), and Restrict (drops and logs).
⚠ Common exam trap
The N10-009 exam often tests the distinction between port security and MAC address filtering: candidates mistakenly choose 'MAC address filtering' because it sounds correct, but the correct term in network security is 'port security' as it is the configured feature on a switch port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port security
Port security is the correct feature because it allows the administrator to specify a list of allowed MAC addresses per switch port. When a device with an unauthorized MAC address attempts to connect, the switch can either block the traffic, generate an alert, or disable the port (errdisable state). This directly enforces access control based on the MAC address list provided.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
802.1X
Why it's wrong here
802.1X is an authentication protocol that requires user credentials, not just MAC address filtering.
When this WOULD be correct
A question asks: 'A company wants to authenticate users and devices connecting to the network using credentials or certificates, with centralized control. Which feature should be enabled on switch ports?' In that scenario, 802.1X is correct.
- ✗
MAC address filtering
Why it's wrong here
MAC address filtering is a general term; on switches it is implemented via port security.
When this WOULD be correct
A question asking: 'A network administrator wants to restrict network access to a list of approved MAC addresses on a wireless network. Which security feature should be configured on the wireless access point?' In that context, MAC address filtering is the correct answer.
- ✓
Port security
Why this is correct
Port security allows restricting access based on MAC addresses, preventing unauthorized devices.
- ✗
VLAN hopping prevention
Why it's wrong here
VLAN hopping prevention protects against VLAN attacks, not device authorization.
When this WOULD be correct
A network administrator wants to prevent an attacker from using double tagging or switch spoofing to gain unauthorized access to other VLANs. Enabling VLAN hopping prevention (e.g., disabling DTP, setting native VLAN to an unused VLAN) would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Port securityCorrect answer▾
Why this is correct
Port security allows restricting access based on MAC addresses, preventing unauthorized devices.
✗802.1XWrong answer — click to see why▾
Why this is wrong here
802.1X is an authentication protocol that requires a RADIUS server and is not used for simple MAC-based allowlisting on a single switch port; it controls network access at the user/device level via EAP, not by a static list of MAC addresses.
★ When this WOULD be the correct answer
A question asks: 'A company wants to authenticate users and devices connecting to the network using credentials or certificates, with centralized control. Which feature should be enabled on switch ports?' In that scenario, 802.1X is correct.
Why candidates choose this
Candidates may confuse 802.1X with MAC-based access control because both involve device identity, but 802.1X is more complex and not designed for simple static MAC allowlists.
✗MAC address filteringWrong answer — click to see why▾
Why this is wrong here
MAC address filtering is typically implemented on wireless access points or as a general network access control, not specifically on a switch port to limit devices per port. Port security is the Cisco-specific feature that binds MAC addresses to a switch port and can restrict the number of allowed MACs.
★ When this WOULD be the correct answer
A question asking: 'A network administrator wants to restrict network access to a list of approved MAC addresses on a wireless network. Which security feature should be configured on the wireless access point?' In that context, MAC address filtering is the correct answer.
Why candidates choose this
Candidates may confuse MAC address filtering with port security because both involve MAC addresses. They might think filtering by MAC address is the same as port security, but port security is a more comprehensive feature for switch ports, while MAC filtering is often associated with wireless or general ACLs.
✗VLAN hopping preventionWrong answer — click to see why▾
Why this is wrong here
VLAN hopping prevention is a security measure to prevent traffic from jumping between VLANs, not to restrict device access based on MAC addresses on a single switch port.
★ When this WOULD be the correct answer
A network administrator wants to prevent an attacker from using double tagging or switch spoofing to gain unauthorized access to other VLANs. Enabling VLAN hopping prevention (e.g., disabling DTP, setting native VLAN to an unused VLAN) would be the correct answer.
Why candidates choose this
Candidates may confuse VLAN hopping with MAC-based access control, or think that preventing VLAN hopping also controls which devices can connect to a port.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on N10-009
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator wants to prevent unauthorized devices from being plugged into switch ports. Only devices with specific MAC addresses should be allowed on each port. Which switch security feature should be enabled?
easy- A.DHCP snooping
- B.Dynamic ARP inspection
- ✓ C.Port security
- D.802.1X
Why C: Port security is the correct feature because it allows the administrator to restrict which MAC addresses can communicate through a switch port. By configuring allowed MAC addresses (sticky or static), any device with an unknown MAC address attempting to send traffic will trigger a security violation (shutdown, restrict, or protect). This directly addresses the requirement to prevent unauthorized devices from being plugged into switch ports.
Variation 2. A network administrator wants to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port. Which security feature should be configured?
medium- A.802.1X
- ✓ B.Port security
- C.DHCP snooping
- D.Dynamic ARP inspection
Why B: Port security is the correct feature because it directly restricts the number of unique MAC addresses that can be learned on a switch port, preventing unauthorized devices from connecting. When the configured limit is exceeded, the switch can take actions such as shutdown, restrict, or protect, effectively blocking the unauthorized device. This is a Layer 2 access control mechanism that operates on the switch port itself.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.