Port security supports which type of port?

SPAN destination ports are placed in a special monitoring mode that cannot enforce port security because they passively receive copied traffic from a source port or VLAN.

Port security cannot be configured on an EtherChannel port-channel logical interface - it must be configured on the individual physical member ports before they join the channel.

A nonnegotiating trunk port (configured with 'switchport nonegotiate') is a supported port type for port security because it is a statically configured interface without dynamic protocol dependencies. Port security can be applied to both access ports and manually configured trunk ports where DTP is disabled, allowing MAC address restriction on trunked links.

DTP-enabled trunk ports use dynamic negotiation, which conflicts with port security requirements; port security requires the port to be in a stable, non-negotiating state.