Port Security Practice Questions

Answers and explanations appear when you work through the set above.

1. Which command actually turns port security on for an interface, after the port mode has been set?

   • switchport port-security
   • switchport port-security maximum 1
   • switchport port-security violation shutdown
   • switchport port-security mac-address sticky

2. What is the default maximum number of secure MAC addresses allowed on a port once port security is enabled, if not otherwise configured?

   • 0
   • 1
   • 2
   • Unlimited

3. What does switchport port-security mac-address sticky do?

   • It statically hardcodes a single MAC address that must be typed manually
   • It dynamically learns MAC addresses seen on the port and adds them to the running configuration as secure addresses
   • It disables port security violations for that port
   • It forces the port to relearn a new MAC address every 30 seconds

4. Which port-security violation mode silently drops offending frames without incrementing the security violation counter, generating violation notifications, or shutting down the interface?

   • shutdown
   • restrict
   • protect
   • err-disable

5. Which port security violation mode is the default, and what does it do when a violation occurs?

   • restrict, drops the frame and logs it but keeps the port up
   • protect, silently drops the frame
   • shutdown, puts the interface into err-disabled state until manual or configured automatic recovery
   • shutdown vlan, disables only the offending VLAN

6. An interface has gone err-disabled due to a port security violation. Which command sequence recovers it manually?

   • clear port-security all, then no shutdown
   • shutdown, then no shutdown on the interface
   • switchport port-security violation restrict
   • clear interface counters

7. Which command displays the violation count, configured maximum, current MAC address count, and violation mode for port security on an interface?

   • show port-security interface <name>
   • show mac address-table
   • show interfaces status
   • show running-config interface <name> only

8. Which command lists every secure MAC address learned or configured across all port-security-enabled interfaces?

   • show port-security address
   • show mac address-table dynamic
   • show port-security
   • show interfaces trunk

9. An access port has port security enabled, a maximum of one secure MAC, and aging disabled. After learning one PC's MAC, it receives a frame from a second distinct PC MAC behind an unmanaged switch. What happens?

   • Both PCs communicate normally, since port security does not track behind-the-switch devices
   • Once a second source MAC address appears, the configured violation action triggers on that port
   • The unmanaged switch is automatically blocked at Layer 3
   • Port security automatically raises the maximum to accommodate multiple devices

10. Why is switchport port-security typically paired with a low maximum value and sticky learning on user-facing access ports rather than trunk ports?

    • Trunk ports cannot support any port security options at all
    • It limits which end devices can use that access port, which is less appropriate on trunk links that intentionally carry traffic from many devices across multiple VLANs
    • Sticky learning only functions on Gigabit interfaces
    • It reduces the switch's total power draw

11. With a nonzero secure-MAC aging time configured for eligible dynamic entries, how does inactivity aging differ from absolute aging?

    • Secure MAC entries age out after a fixed time regardless of activity
    • Secure MAC entries age out only if that specific MAC address has been idle for the aging time, rather than aging from when it was first learned
    • Aging is disabled entirely
    • It converts all dynamic entries into static entries

12. An administrator wants a specific known MAC address permanently bound to an access port even after a reload, without relying on sticky learning. Which command achieves this?

    • switchport port-security mac-address <mac-address>
    • switchport port-security maximum <mac-address>
    • mac address-table static <mac-address>
    • switchport port-security violation protect

13. Which output distinguishes an err-disabled port from one that is administratively shut down, without by itself proving the errdisable cause?

    • show interfaces status, showing a status of err-disabled
    • show vlan brief, showing the port missing from its VLAN
    • show cdp neighbors, showing no neighbor
    • show spanning-tree, showing the port in blocking state

14. Sticky secure MAC addresses appear in show running-config as which type of command?

    • switchport port-security mac-address sticky <mac-address>, added automatically under the interface
    • A separate global mac address-table entry only
    • They never appear in the running configuration, only in show mac address-table
    • vlan database entries