How Port Security Restricts a Switch to Assigned Devices
Short answer
C Enable port security on the new switch so each access port permits only the MAC addresses of assigned devices and blocks unauthorized ones.
Question
Key Takeaways
This item tests the difference between switch-port device admission and general traffic filtering, with ACLs as the trap because they filter packets but do not bind a port to assigned MAC addresses.
Port security is the switch feature that restricts each access port to authorized MAC addresses. In this N10-009 scenario, the administrator should enable port security (C) so only assigned devices can connect to the new switch.
Common mistake: Choosing ACLs (A) is the common mistake; ACLs filter traffic by IP, port, and protocol criteria but do not stop an unassigned device from using a switch access port unless a MAC-based port control is also in place.
Expert Analysis
The requirement is Layer 2 admission control The phrase "only assigned devices can connect to the switch" asks who may use an access port, not which packets may cross a routed boundary. When a device is plugged into a switch port, the switch observes the source MAC address in incoming frames. Port security lets the administrator define the permitted MAC address or addresses for each interface, statically or learned and made sticky, and enforce that list per port. That is the mechanism described by option C.
Tracing the connection attempt A newly connected device sends its first frame. The switch compares the frame's source MAC address against the secure MAC list bound to that interface. If the MAC address is on the list and the maximum count is not exceeded, the port forwards normally. If it is not, the port security violation action applies: protect silently drops, restrict drops and logs or counts, and shutdown puts the port into an err-disabled state. The restriction therefore happens at the access port before the device gains normal switch access, which is exactly what the scenario requests.
Why the other options do not satisfy it ACLs (A) filter traffic using IP addresses, transport ports, and protocol fields; they do not bind a switch port to a particular endpoint's MAC address and generally act on traffic after the device is already connected. A captive portal (B) presents a web authentication page for users or guests, which is a higher-layer access workflow and not a per-port device admission rule. Disabling unnecessary services (D) is good hardening, but it reduces exposed services and does not prevent an unassigned device from connecting to a switch port. Comments on this item make the same essential distinction: "only assigned devices can connect" points to MAC-based port security, and port security is the switch feature that controls which device may use a port.
Operational note Port security is not a substitute for all security controls, because MAC addresses can be spoofed and an authorized device can still send malicious traffic, so combine it with unused-port shutdown, VLAN segmentation, and ACLs where appropriate. For this question, the direct action is to enable port security.
Official Reference
https://www.comptia.org/certifications/network
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a stem says only assigned or authorized devices may connect, translate that into Layer 2 identity binding rather than traffic filtering. Look for the switch-native feature that learns or statically maps MAC addresses per interface, and reject options that control user web access, filter routed packets, or harden general services. Confirm where enforcement occurs: ACLs and captive portals act at different points in the path, while port security enforces the access port itself.
Frequently Asked Questions
Why doesn't an ACL satisfy the requirement to allow only assigned devices on a switch?
How does port security determine which device is assigned to a port?
Can port security stop an authorized device from sending malicious traffic?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
BobbyCruz111 👍 11 Answered CPort security is a feature available on most network switches that allows you to control which devices can connect to a particular switch port based on MAC addresses. By enabling port security, the network administrator can restrict each port to only allow a specific set of MAC addresses, ensuring that only authorized devices can connect. If an unauthorized device tries to connect, the switch can take actions such as shutting down the port, dropping the traffic, or sending an alert.
-
ramankatoch 👍 3 Answered C"Only assigned devices can connect to the switch" is the keyword related to MAC, which means Port security
-
chupapi_001 👍 1 Answered CThe correct answer is C. Enable port security.
-
Dese_2point71 👍 1 Answered CC. Enable port security.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All N10-009 Questions
Access 100 questions with complete answers and detailed explanations.
View Full N10-009 Practice Test →