200-301 Question 442
Single answerA network administrator has configured port security on a switch interface to prevent unauthorized devices from accessing the network. The administrator allows a maximum of 2 MAC addresses per port and enables the violation mode to 'restrict'. The administrator notices that one of the connected devices is no longer communicating with the network after an unauthorized device was connected to the same port. Which of the following statements explain what is happening in this scenario?
- A
The unauthorized MAC address was added to the secure MAC address table, and the port is now in an error-disabled state.
- B
The unauthorized MAC address triggered a violation, and the port is sending log messages while dropping frames from the unauthorized MAC address.
- C
The port is shut down automatically due to the violation mode being set to 'restrict'.
- D
The switch interface is blocking only the unauthorized device's traffic while allowing traffic from the previously authorized devices.
Show answer and explanation
Correct answer: B
Explanation
In this scenario, the violation mode is set to 'restrict', which means the switch will drop frames from any unauthorized MAC addresses, log the violation, and send SNMP traps if configured. The port will not be shut down, and traffic from authorized MAC addresses will not be affected. This behavior ensures that the network remains secure while minimizing disruption for authorized devices.
- A. Incorrect.
This is incorrect. In the 'restrict' violation mode, the port does not enter an error-disabled state; it only drops packets from unauthorized MAC addresses and logs the violation.
- B. Correct.
This is correct. In 'restrict' mode, the unauthorized MAC address triggers a violation, and the port drops frames from the unauthorized MAC address while logging the event. Authorized devices continue to function normally.
- C. Incorrect.
This is incorrect. The port would shut down only if the violation mode was set to 'shutdown'. In 'restrict' mode, the port does not shut down.
- D. Incorrect.
This is incorrect. While the port does block traffic from the unauthorized MAC address, it does not block traffic selectively. Instead, it drops all frames from the unauthorized MAC address and logs the violation.