Designers want an AP switchport to shut if someone swaps the AP for a soft-AP phone bridge. What design intent does a port-security violation shutdown express?
Select an answer to reveal the explanation.
Short Explanation
If a phone pretends to be the AP, port security should slam the port shut—that is the design intent. Auto-widening trunks or ignoring MAC swaps helps the attacker.
Full Explanation
Designers who want an AP switchport to shut when someone swaps the AP for a soft-AP phone bridge are expressing port-security violation shutdown intent: the port closes when an unexpected MAC replaces the trusted AP. That fail-closed response protects the wired VLAN set from an unauthorized bridge more aggressively than alert-only modes. It is an appropriate civic edge control wherever hallway drops or unlocked closets make physical tampering plausible. Inviting any MAC onto the AP port after three soft failures weakens the control and trains the network to accept strangers. Ignoring MAC changes because PoE will always detect bridges is false—power delivery does not equal trusted AP identity. Converting the violation into a wider VLAN trunk automatically expands access for the attacker rather than containing the incident. Exam caveat: legitimate AP replacements need a documented break-glass procedure to clear sticky MAC entries and restore service, or overnight maintenance becomes an accidental outage generator for that floor. Operational check: configure shutdown on violation with the known AP MAC, replace the AP with a different MAC in the lab, confirm the port err-disables, and practice the authorized recovery steps operators will use in production buildings.