Which port-security violation mode drops traffic from unknown MAC addresses and sends an SNMP trap?

The 'restrict' port-security violation mode drops packets from unknown source MAC addresses, increments the violation counter, and generates a Simple Network Management Protocol (SNMP) trap and a syslog message. This provides notification of the violation without shutting down the port. 'shutdown' is incorrect because it disables the port and puts it into an error-disabled state, requiring manual intervention or err-disable recovery. 'protect' is incorrect because it drops packets from unknown source MAC addresses but does not increment the violation counter or send any notifications. 'shutdown VLAN' is not a valid port-security violation mode.