easyMultiple ChoiceObjective-mapped

Port Security Violation: Why a Switch Port Goes err-disabled

Exhibit

interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation shutdown
 switchport port-security mac-address sticky

Refer to the exhibit. A network administrator configured the above on a switch port. After connecting a single workstation, the port goes into err-disabled state within minutes. What is the most likely cause?

Quick Answer

The answer is that the workstation is sending traffic with multiple source MAC addresses. This is the most likely cause because the port-security configuration sets a maximum of two MAC addresses with a violation mode of shutdown, meaning the switch port goes err-disabled the moment it detects more than two unique source MACs—even if only one physical device is connected. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your understanding of how port security violation cause err-disabled states, often disguising a virtual machine host or a downstream switch as a single workstation. A common trap is assuming the device itself is faulty, when in reality the switch is enforcing the MAC address limit. Remember the mnemonic: “One device, many MACs—err-disabled attacks.”

⚠ Common exam trap

ISC2 often tests the misconception that the maximum MAC count is the only factor, when in reality a single device can generate multiple MAC addresses (e.g., via virtualization or bridging), causing a violation even with a seemingly generous limit like 2.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The workstation is sending traffic with multiple source MAC addresses.

The port-security configuration with a maximum MAC address count of 2 and violation mode 'shutdown' causes the port to err-disable when a single workstation sends traffic with multiple source MAC addresses. This is a classic symptom of a device (e.g., a virtual machine host or a switch behind the port) generating frames from different MACs, exceeding the allowed limit and triggering the violation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The workstation is sending traffic with multiple source MAC addresses.
Why this is correct
Exceeding the maximum MAC count triggers violation shutdown.
✗
The port-security maximum is set to 2, so it should allow up to 2 MACs; the issue is elsewhere.
Why it's wrong here
If the workstation sends more than 2 MACs, it will still violate the limit.
✗
Sticky MAC learning is disabled.
Why it's wrong here
The command shows 'sticky' is enabled, so that is not the issue.
✗
The violation mode should be 'restrict' instead of 'shutdown'.
Why it's wrong here
Restrict would not cause shutdown, but the issue is exceeding the MAC limit.

Quick reference

Access Control Model Comparison

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

Go deeper

1 more way this is tested on CC

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security administrator is concerned about MAC address spoofing on the network. Which technology can help mitigate this risk by associating a specific MAC address with a port?

medium

✓ A.Port security
B.Dynamic ARP inspection
C.DHCP snooping
D.VLAN hopping prevention

Why A: Port security is the correct answer because it directly mitigates MAC address spoofing by allowing an administrator to statically or dynamically associate a specific MAC address with a switch port. When a device with a different MAC address attempts to use that port, port security can either disable the port (errdisable) or drop the traffic, preventing unauthorized access. This is a Layer 2 security feature that enforces MAC-to-port binding.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Ready to practise?

Turn this into a habit — start a practice session.

Start practice session

Practice tests

Quick scored rounds with instant marking and a written explanation per question.

ISC2 CC Practice Test 1 — 25 Questions→ISC2 CC Practice Questions 1 — 50 Questions→

Study by exam domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Business Continuity, DR & Incident Response Security Principles Security Operations

Practice by question type

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Topic-level practice

Each topic page collects the questions that test one concept, plus the theory behind it.

Security Principles practice questions Business Continuity, DR & Incident Response practice questions CC fundamentals practice questions CC troubleshooting practice questions

Keep going

All ISC2 practice questions All CC questions Study guide

This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.