How to limit public switch ports to managed devices
Short answer
D Implement port security on publicly accessible switch ports to bind access to authorized managed-device MAC addresses and block unknown devices.
Question
Key Takeaways
This question tests whether you can distinguish switch port security from broader segmentation and wireless-style filtering; the trap is choosing MAC filtering as a generic phrase instead of the switch feature that enforces authorized MACs and violation actions per port.
Port security is the switch-level control that limits a publicly accessible wired port to authorized managed-device MAC addresses. On this N10-009 question, port security (D) is the best answer, not MAC filtering or geofencing.
Common mistake: Choosing MAC filtering (C) because it also restricts by hardware address misses the wired-switch context, where port security supplies per-port MAC limits, sticky learning, and violation responses that actually block an unknown device.
Expert Analysis
The switch port is the enforcement point The unknown device is already connected to a wired switch port in a publicly accessible area. The control that best limits access to managed devices only must act at that exact port. Port security lets an administrator permit specific authorized MAC addresses, cap the number of learned MAC addresses, and define a violation action such as shutdown or restrict. That makes option D the correct answer.
Why the other choices do not fit the trigger A trusted zone is a broader segmentation concept and does not identify which endpoint is managed on an exposed access port. A screened subnet is a DMZ design for public-facing services, not a lobby switch port. MAC filtering sounds close because it also uses hardware addresses, but in this wired-switch scenario port security is the switch-native feature that combines authorized MAC binding, MAC-count limits, sticky learning, and violation responses. Geofencing is location-based policy and cannot stop a device already inside the building.
Adjacent decisions and the scenario that would flip the answer If the unknown device were connecting over Wi-Fi, the discussion would shift toward 802.1X/EAP, WLAN MAC filtering, or a wireless intrusion system. If the concern were isolating public-facing servers, a screened subnet would matter. If the goal were merely to permit selected MAC addresses while leaving the port available for other traffic, a MAC ACL might be considered, but port security remains the typical switch-port control for this wording. The supplied reasoning also points to option D, noting that port security ties allowed traffic to specific authorized MAC addresses or a limited count and drops rogue traffic. A design change matters: if port security uses a high maximum-MAC value, a rogue can coexist with legitimate devices; if shutdown mode is used on exposed ports, a malicious device can intentionally trigger repeated outages.
Operational consequence Without port security, unused live switch ports in public areas become easy entry points that bypass perimeter and segmentation controls. The likely result is unauthorized network access, malware propagation, or data exposure. Mature designs combine port security with disabling unused ports, 802.1X where feasible, and monitoring so violations are investigated rather than ignored.
Official Reference
https://www.comptia.org/certifications/network
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a stem mentions a publicly accessible switch and asks to allow managed devices only, find the most local enforcement point before considering broad security terms. Port security, 802.1X, and disabling unused ports are wired access controls; MAC filtering, trusted zones, and geofencing are usually distractors unless the stem is about wireless, segmentation, or location policy. Also watch the violation mode: shutdown protects access but can be abused for denial of service on exposed ports, so production designs pair it with monitoring and unused-port shutdown.
Frequently Asked Questions
Why is port security better than MAC filtering for a public wired switch port?
What happens when port security detects an unauthorized device?
What else should be done with switch ports in public areas?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
ERB14 👍 1 Answered DD. Port security: Port security allows an administrator to restrict access on individual switch ports by tying allowed traffic directly to specific, authorized MAC addresses (or a limited count of learned MAC addresses) of managed devices. If an rogue or unmanaged device is plugged into a publicly accessible switch port, port security immediately shuts down the port or drops the rogue traffic, preventing unauthorized network access.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All N10-009 Questions
Access 100 questions with complete answers and detailed explanations.
View Full N10-009 Practice Test →