Port Security for New Devices and Moved Workstations

Where the policy must be enforced The correct answer is D: port security. The requirement is not about which IP addresses may talk to each other; it is about whether a device may attach to a particular switch access port at all. Port security is the Layer 2 feature that binds an access port to approved source MAC addresses, either administratively or through sticky learning, and enforces a maximum number of MACs per port. Trace the path: a workstation cable is plugged into a switch port, the switch learns the source MAC in the Ethernet frame before forwarding it, and port security compares that MAC with the port's allowed set. If the device is new and has no clearance, the MAC is not approved; if an approved workstation is moved to a different port, the new port does not have that binding. Either way, the configured violation action—protect, restrict, or shutdown—blocks or logs the event. Shutdown is the strictest, err-disabling the port until an administrator intervenes.

Why the other options miss Static routing (A) only populates routes and has nothing to do with endpoint admission. An ACL (B) can permit or deny IP or transport traffic, but it does not know which physical switch port a workstation is plugged into, so it cannot stop a newly connected endpoint from appearing on the wire or detect a move from one access port to another. Content filtering (C) is an application or URL control, typically at a proxy or next-generation firewall, and only handles allowed content flows after connectivity exists. The comment thread makes the same distinction: port security restricts switch-port access by MAC address and can prevent unauthorized devices or moved workstations unless IT approves the new binding. That is exactly the physical-access enforcement the policy calls for.

Operational consequence In practice, configure the access ports with a maximum of one approved MAC, enable sticky learning only if the operational model supports it, and choose shutdown for the strict policy. IT must then approve moves by updating the binding or clearing an err-disabled port; without that approval workflow, legitimate relocations will also be blocked, which is the intended trade-off.