CCNA Switching and Network Access Practice Question
A Layer 2 switch port connected to an end host should move to forwarding quickly but also shut down if a BPDU is received. Which pair of features best supports that design?
⚠ Common exam trap
Be careful not to confuse BPDU Guard with Root Guard or Loop Guard, as they serve different purposes in spanning tree protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PortFast and BPDU Guard
PortFast and BPDU Guard are the right pair. In plain language, PortFast makes an edge port usable quickly for a real end device, while BPDU Guard protects that same port by shutting it down if spanning-tree control traffic appears unexpectedly. This is a classic access-layer design. PortFast improves usability, and BPDU Guard improves safety. The best answer combines both functions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
PortFast and BPDU Guard
Why this is correct
PortFast immediately transitions an access port to the forwarding state, bypassing the listening and learning STP states so the end host can start sending traffic without delay. BPDU Guard protects the STP topology by disabling any PortFast port that receives a BPDU, which indicates an unauthorized switch or bridge has been connected. Together they are the required configuration for a trusted edge port attached to a single end host.
- ✗
Root Guard and UDLD
Why it's wrong here
Root Guard is a spanning-tree feature that prevents a designated port from becoming a root port by placing the port in root-inconsistent state if it receives a superior BPDU, and it is used on ports that should never become the root bridge, not on edge ports. UDLD (Unidirectional Link Detection) detects and disables unidirectional fiber or copper links, but it does not affect the port's forwarding state during STP convergence. Neither feature speeds up initial forwarding for an end host nor protects against rogue BPDUs, so it does not meet the access-port requirement.
When this WOULD be correct
In a scenario where the question asks for features that prevent a switch port from becoming a root port while also ensuring link integrity, Root Guard would be appropriate. For example, a question might focus on maintaining a stable root topology in a network with multiple switches.
- ✗
Loop Guard and native VLAN
Why it's wrong here
Loop Guard prevents alternate or root ports from becoming designated when BPDUs stop being received on a redundant link, which protects against loops caused by unidirectional link failures, but it is not intended for edge ports and does not accelerate forwarding. The native VLAN is a VLAN assignment for frames on a trunk link that lack an 802.1Q tag, so it is irrelevant to an access port connected to a single end host. This combination neither enables fast transition nor provides BPDU filtering, making it an incorrect choice for an edge-port configuration.
When this WOULD be correct
In a scenario where the question asks for features that prevent loops in a network with redundant paths, Loop Guard could be the correct answer. For instance, if the question specifies maintaining network stability while allowing certain VLAN configurations, this option would be appropriate.
- ✗
Port security and EtherChannel
Why it's wrong here
Port security restricts the number of MAC addresses allowed on a port and can take action if a violation occurs, but it does not bypass the STP listening and learning states or alter how the port receives BPDUs. EtherChannel is a link aggregation technology that bundles multiple physical links into one logical link, which has nothing to do with STP edge-port behavior or protecting the spanning-tree domain. These features address different concerns, so they are not the correct set for a layer 2 switch port connected to an end host.
When this WOULD be correct
In a scenario where the question asks for features that enhance security and stability on a switch port, specifically in a multi-link environment, 'Port security and EtherChannel' could be correct. For example, if the question emphasizes preventing unauthorized devices while allowing multiple links for redundancy, this option would be valid.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓PortFast and BPDU GuardCorrect answer▾
Why this is correct
PortFast immediately transitions an access port to the forwarding state, bypassing the listening and learning STP states so the end host can start sending traffic without delay. BPDU Guard protects the STP topology by disabling any PortFast port that receives a BPDU, which indicates an unauthorized switch or bridge has been connected. Together they are the required configuration for a trusted edge port attached to a single end host.
✗Root Guard and UDLDWrong answer — click to see why▾
Why this is wrong here
Root Guard and UDLD do not directly address the requirement for a port to quickly transition to forwarding while shutting down upon receiving a BPDU. Root Guard is used to prevent a port from becoming a root port, while UDLD is for detecting unidirectional links.
★ When this WOULD be the correct answer
In a scenario where the question asks for features that prevent a switch port from becoming a root port while also ensuring link integrity, Root Guard would be appropriate. For example, a question might focus on maintaining a stable root topology in a network with multiple switches.
Why candidates choose this
Candidates may choose this option because they recognize the need for stability in a spanning tree environment and associate Root Guard with preventing topology changes, leading to confusion about its applicability in the context of BPDU handling.
✗Loop Guard and native VLANWrong answer — click to see why▾
Why this is wrong here
Loop Guard and native VLAN do not directly address the requirement for a port to quickly transition to forwarding while shutting down upon receiving a BPDU. Loop Guard is designed to prevent loops by keeping a port in a loop-inconsistent state, and native VLAN is related to VLAN tagging, not port state management.
★ When this WOULD be the correct answer
In a scenario where the question asks for features that prevent loops in a network with redundant paths, Loop Guard could be the correct answer. For instance, if the question specifies maintaining network stability while allowing certain VLAN configurations, this option would be appropriate.
Why candidates choose this
Candidates may find this option tempting because they recognize the importance of preventing network loops and may mistakenly believe that Loop Guard is relevant to the overall stability of Layer 2 switching, even though it does not fulfill the specific requirements of the question.
✗Port security and EtherChannelWrong answer — click to see why▾
Why this is wrong here
Port security and EtherChannel do not directly address the need for a switch port to quickly transition to forwarding mode while also shutting down upon receiving a BPDU. Port security focuses on limiting MAC addresses and EtherChannel is used for link aggregation, neither of which fulfill the specific requirements of this question.
★ When this WOULD be the correct answer
In a scenario where the question asks for features that enhance security and stability on a switch port, specifically in a multi-link environment, 'Port security and EtherChannel' could be correct. For example, if the question emphasizes preventing unauthorized devices while allowing multiple links for redundancy, this option would be valid.
Why candidates choose this
Candidates might choose this option because they recognize the importance of securing switch ports and may mistakenly associate EtherChannel with improved performance and reliability, leading them to believe it fits the question's context.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
PortFast
PortFast is a Cisco switch feature that immediately brings a port into the forwarding state, bypassing the normal Spanning Tree Protocol (STP) listening and learning phases, so that devices connected to that port can start communicating right away.
Key term
BPDU Guard
BPDU Guard is a Cisco switch feature that protects the network from unauthorized devices by disabling a port if it receives a Bridge Protocol Data Unit (BPDU).
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.