Port Security Practice Questions

Answers and explanations appear when you work through the set above.

1. Which command actually turns port security on for an interface, after the port mode has been set?

   • switchport port-security
   • switchport port-security maximum 1
   • switchport port-security violation shutdown
   • switchport port-security mac-address sticky

2. What is the default maximum number of secure MAC addresses allowed on a port once port security is enabled, if not otherwise configured?

   • 0
   • 1
   • 2
   • Unlimited

3. What does switchport port-security mac-address sticky do?

   • It statically hardcodes a single MAC address that must be typed manually
   • Learns secure MACs in running-config
   • Disables all port-security violation handling for that port
   • It forces the port to relearn a new MAC address every 30 seconds

4. Which port-security violation mode silently drops offending frames without incrementing the security violation counter, generating violation notifications, or shutting down the interface?

   • shutdown
   • restrict
   • protect
   • err-disable

5. Which port security violation mode is the default, and what does it do when a violation occurs?

   • restrict, drops the frame, logs the violation, and places the interface into err-disabled state
   • protect, silently drops the frame
   • shutdown, err-disables the port until manual or automatic recovery
   • shutdown vlan, disables only the offending VLAN

6. An interface has gone err-disabled due to a port security violation. Which command sequence recovers it manually?

   • clear port-security all, then no shutdown
   • Interface shutdown, then no shutdown
   • switchport port-security violation restrict, then clear counters
   • Clear interface counters, then reset the violation count

7. Which command displays the violation count, configured maximum, current MAC address count, and violation mode for port security on an interface?

   • show port-security interface <name>
   • show mac address-table
   • show interfaces status
   • show running-config interface <name> | section security

8. Which command lists every secure MAC address learned or configured across all port-security-enabled interfaces?

   • show port-security address
   • show mac address-table dynamic
   • show port-security
   • show interfaces status

9. An access port has port security enabled, a maximum of one secure MAC, and aging disabled. After learning one PC's MAC, it receives a frame from a second distinct PC MAC behind an unmanaged switch. What happens?

   • Both PCs communicate normally because the unmanaged switch hides their source MAC addresses
   • Once a second source MAC address appears, the configured violation action triggers on that port
   • The unmanaged switch is automatically blocked at Layer 3
   • Port security automatically raises the maximum to accommodate multiple devices

10. Why is switchport port-security typically paired with a low maximum value and sticky learning on user-facing access ports rather than trunk ports?

    • Trunks cannot support port security because 802.1Q tags replace source MAC addresses
    • Access ports serve few endpoints; trunks serve many
    • Sticky learning requires a Gigabit-speed interface to track MAC addresses
    • Port security reduces the power consumed by access interfaces

11. With a nonzero secure-MAC aging time configured for eligible dynamic entries, how does inactivity aging differ from absolute aging?

    • Secure MAC entries age out after a fixed time regardless of activity
    • Inactivity ages idle MACs; absolute aging runs from learning time
    • Aging is disabled entirely
    • It converts all dynamic entries into static entries

12. An administrator wants a specific known MAC address permanently bound to an access port even after a reload, without relying on sticky learning. Which command achieves this?

    • switchport port-security mac-address <mac-address>
    • switchport port-security maximum <mac-address>
    • mac address-table static <mac-address>
    • switchport port-security violation protect

13. Which output distinguishes an err-disabled port from one that is administratively shut down, without by itself proving the errdisable cause?

    • show interfaces status, showing a status of err-disabled
    • show vlan brief, identifying the port's errdisable reason from its absence in the VLAN
    • show cdp neighbors, showing no neighbor
    • show spanning-tree, showing the port in blocking state

14. Sticky secure MAC addresses appear in show running-config as which type of command?

    • switchport port-security mac-address sticky <mac-address>, stored under the interface
    • A separate global mac address-table entry only
    • They never appear in the running configuration, only in show mac address-table
    • vlan database entries