200-301 Question 444
Select 3A network administrator wants to use port security to prevent unauthorized devices from connecting to a switch port. They configure the port with the following command sequence:
switch(config-if)# switchport mode access switch(config-if)# switchport port-security switch(config-if)# switchport port-security maximum 2 switch(config-if)# switchport port-security violation restrict switch(config-if)# switchport port-security mac-address sticky
Which of the following statements are true about this configuration?
- A
The port will only allow up to two MAC addresses to connect at a time.
- B
If a violation occurs, packets from the unauthorized MAC address will be dropped, but the port will remain operational.
- C
The MAC addresses learned on the port will be saved in the running configuration.
- D
The port will automatically shut down if more than two MAC addresses are detected.
- E
The port is configured as a trunk port.
Show answer and explanation
Correct answers: A, B, C
Explanation
This port security configuration ensures that a maximum of two MAC addresses can connect to the port. If a violation occurs, unauthorized packets are dropped, and the event is logged while the port remains operational. Sticky MAC addresses allow dynamic learning of MAC addresses, which are saved to the running configuration. The port is configured as an access port, not a trunk port, and the 'restrict' mode avoids shutting down the port on violations.
- A. Correct.
Correct. The 'switchport port-security maximum 2' command limits the number of allowed MAC addresses on the port to two.
- B. Correct.
Correct. The 'switchport port-security violation restrict' command ensures that packets from unauthorized MAC addresses are dropped, but the port remains operational and logs the violation.
- C. Correct.
Correct. The 'switchport port-security mac-address sticky' command dynamically learns MAC addresses and saves them to the running configuration.
- D. Incorrect.
Incorrect. The 'restrict' violation mode does not shut down the port. Instead, it drops unauthorized packets and logs the violation.
- E. Incorrect.
Incorrect. The command 'switchport mode access' configures the port as an access port, not a trunk port.