Refer to the exhibit.

What three actions will the switch take when a frame with an unknown source MAC address arrives
at the interface? (Select three.)

A.
Send an SNMP trap.

B.
Send a syslog message.

C.
Increment the Security Violation counter.

D.
Forward the traffic.

E.
Write the MAC address to the startup-config.

F.
Shut down the port.

Explanation:
Switchport Security Concepts and Configuration
http://www.ciscopress.com/articles/article.asp?p=1722561
Switchport Security Violations The second piece of switchport port-security that must be understood
is a security violation including what it is what causes it and what the different violation modes that
exist. A switchport violation occurs in one of two situations: When the maximum number of secure
MAC addresses has been reached (by default, the maximum number of secure MAC addresses per
switchport is limited to 1) An address learned or configured on one secure interface is seen on
another secure interface in the same VLAN The action that the device takes when one of these
violations occurs can be configured: Protect—This mode permits traffic from known MAC addresses
to continue to be forwarded while dropping traffic from unknown MAC addresses when over the
allowed MAC address limit. When configured with this mode, no notification action is taken when
traffic is dropped. Restrict—This mode permits traffic from known MAC addresses to continue to be

forwarded while dropping traffic from unknown MAC addresses when over the allowed MAC
address limit. When configured with this mode, a syslog message is logged, a Simple Network
Management Protocol (SNMP) trap is sent, and a violation counter is incremented when traffic is
dropped. Shutdown—This mode is the default violation mode; when in this mode, the switch will
automatically force the switchport into an error disabled (err-disable) state when a violation occurs.
While in this state, the switchport forwards no traffic. The switchport can be brought out of this
error disabled state by issuing the errdisable recovery cause CLI command or by disabling and reenabling the switchport. Shutdown VLAN—This mode mimics the behavior of the shutdown mode
but limits the error disabled state the specific violating VLAN.