Cisco CCNA (200-301)Security FundamentalsMedium
A switch port running port security has entered the err-disabled state due to a security violation. The administrator wants the interface to automatically recover after 5 minutes without manual intervention. Which set of commands accomplishes this?
- Ashutdown no shutdown
- Berrdisable recovery cause psecure-violation errdisable recovery interval 300
- Cswitchport port-security aging time 300
- Derrdisable detect cause psecure-violation
Show answer & explanationAnswer & explanation
Correct answer: B. errdisable recovery cause psecure-violation errdisable recovery interval 300
To enable automatic recovery from err-disabled state caused by port security violations, the global commands 'errdisable recovery cause psecure-violation' (enables auto-recovery for that specific cause) and 'errdisable recovery interval 300' (sets recovery timer in seconds) must both be configured.
Why the other options are wrong
- A. Manual shutdown/no shutdown works but is not automatic and requires administrator action.
- C. Aging time controls how long learned secure MAC addresses remain, not err-disable recovery.
- D. 'errdisable detect cause' enables detection, not automatic recovery timing.
Errdisable Recovery
Global commands that allow a switch to automatically bring an err-disabled port back up after a specified time interval for a given cause.
- errdisable recovery cause <cause> enables auto-recovery for that trigger
- errdisable recovery interval <seconds> sets the timer (default 300s)
- Without these commands, manual shutdown/no shutdown is required
Memory trick: Set the cause, set the clock, let the port wake itself up.