Port security

Port security is a switch-level access control that allows or blocks devices from connecting to a physical switch port based on the device's MAC address (its hardware identifier), preventing unauthorized devices from joining the network.

Verified for the 2027 AP Cybersecurity examLast updated June 2026

What is port security?

Port security is a feature you configure on a network switch that ties physical ports to specific devices. Each device has a MAC address, a unique hardware identifier baked into its network card. Port security lets a switch check that MAC address and decide whether the device is allowed to connect. Plug in an unknown laptop and the port can shut down, ignore it, or fire off an alert.

In AP Cybersecurity, this lives inside the idea of a switch security policy, the minimum configuration standard an organization sets for its switches (EK 3.2.A.2). A good switch policy bans local user accounts and forces logins through an approved authentication server, and port security is the piece that controls the physical layer of access. Think of it as a bouncer at every wall jack who only lets in devices on the guest list.

Why port security matters in AP Cybersecurity

Port security sits in Unit 3: Securing Networks, specifically topic 3.2 on managerial controls and wireless security. It supports learning objective AP Cybersecurity 3.2.A, which asks you to identify managerial controls related to network security, and it ties directly to EK 3.2.A.2 on switch security policies. The exam treats it as a defense-in-depth control: you stop threats before they ever reach higher layers like firewalls or encryption. Knowing port security means knowing how organizations enforce the rule that only approved hardware touches the network.

Keep studying AP Cybersecurity Unit 3

How port security connects across the course

Switch Security Policy (Unit 3)

Port security is one tool a switch security policy enforces. The policy is the written rule (only approved devices connect), and port security is the switch setting that makes the rule real by checking MAC addresses.

Router Security Policy (Unit 3)

Routers and switches both get minimum configuration standards under EK 3.2.A. The router policy bans local accounts and disables services like Telnet; the switch policy adds port security. Same managerial-control idea, different device.

Wireless Access Point Hardening (Unit 3)

Port security locks down wired connections by hardware ID, while WAP controls (disabling beacon frames, limiting signal strength, EK 3.2.B) lock down wireless ones. Both answer the same question: who gets to connect?

Is port security on the AP Cybersecurity exam?

Expect port security in multiple-choice questions about switch security policies and managerial controls. A classic stem describes an admin who wants to stop unauthorized devices from connecting to a switch and asks which technique controls access based on a device's hardware identifier; the answer is port security. You may also see it contrasted with router-policy controls (forcing logins through an authentication server) or with wireless controls, so be ready to match the right control to the right device. No released FRQ uses the exact term, but it supports the kind of layered-defense reasoning a network-security response rewards.

Port security vs Firewall rules

A firewall filters traffic based on IP addresses, ports, and protocols, usually at the network boundary. Port security works earlier and lower, at the physical switch port, deciding whether a device's MAC address is even allowed to plug in. One blocks bad traffic; the other blocks bad devices.

Key things to remember about port security

  • Port security is a switch feature that allows or blocks devices based on their MAC address, the hardware identifier on a network card.

  • It is part of a switch security policy, the minimum configuration standard for switches under EK 3.2.A.2.

  • It supports learning objective AP Cybersecurity 3.2.A on identifying managerial controls for network security.

  • On the exam, the giveaway phrase is 'control access based on a device's hardware identifier,' which points to port security.

  • It enforces access at the physical layer, before a device can even reach firewalls or encryption higher up.

Frequently asked questions about port security

What is port security in AP Cybersecurity?

It's a switch setting that allows or blocks devices from connecting to a physical port based on their MAC address. It's one of the managerial controls covered under EK 3.2.A.2 in Unit 3.

Is port security the same as a firewall?

No. A firewall filters network traffic by IP, port, and protocol, usually at the network edge. Port security works at the switch and decides whether a specific device's hardware can connect at all.

How is port security different from a router security policy?

Both are managerial controls under AP Cybersecurity 3.2.A, but a router security policy bans local accounts and disables services like Telnet on routers, while port security is a switch-level control that restricts which devices can plug into a port.

Does port security use MAC addresses or IP addresses?

MAC addresses. A MAC address is the device's permanent hardware identifier, so port security checks the hardware itself rather than the changeable IP address.

Is port security on the AP Cybersecurity exam?

Yes, it shows up in multiple-choice questions about switch security policies and managerial controls, especially stems asking which technique allows or blocks access based on a device's hardware identifier.

Keep studying AP Cybersecurity

Connect this key term to the AP exam workflow: review the course, practice questions, and check related study tools.