Which port-security violation mode drops traffic from unknown MAC addresses and forwards an SNMP trap?

`shutdown VLAN` is not a standard port security violation mode; the standard `shutdown` mode disables the entire interface and puts it into an error-disabled state.

The `protect` violation mode drops packets from unauthorized MAC addresses but does not log a violation or send an SNMP trap, making it less visible to administrators.

The `restrict` port security violation mode drops packets from an unknown source MAC address, prevents further traffic from that address, increments the security violation counter, and importantly, sends an SNMP trap notification to alert network administrators.

The `shutdown` violation mode immediately disables the port when a violation occurs, placing it in an error-disabled state and requiring manual intervention or automatic recovery; while it sends an SNMP trap, its primary action is to disable the port, not just drop traffic while keeping the port up.