CCNA Switching and Network Access Practice Question
A port connected to an end host is configured with PortFast and BPDU Guard. What is the most likely result if a small unmanaged switch is connected and starts sending BPDUs?
⚠ Common exam trap
Remember, BPDU Guard disables the port, it doesn't use spanning-tree states like blocking or learning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The port is error-disabled by BPDU Guard.
The most likely result is that the port is placed into an err-disabled state by BPDU Guard. In practical terms, PortFast tells the switch to treat the interface like an edge port for a normal endpoint, which is why it starts forwarding quickly. BPDU Guard protects that assumption. If the port suddenly receives a spanning-tree BPDU, the switch treats that as a sign that the port is no longer connected to a simple end device. This combination is common in enterprise access-layer design because it improves user startup time while still protecting the topology. The correct answer is the one that describes the port being shut down automatically when BPDUs appear unexpectedly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The port is error-disabled by BPDU Guard.
Why this is correct
BPDU Guard is a PortFast enhancement that places the port into the errdisable state whenever a BPDU is received on an edge port. Since PortFast assumes the port connects to an end host, any incoming BPDU signals a potential bridging loop or switch misconfiguration. The switch immediately shuts down the port to protect the spanning-tree topology, overriding any normal STP processing that might otherwise occur.
- ✗
The port automatically becomes the root port.
Why it's wrong here
A port becomes the root port only after STP evaluates BPDUs and determines that the port has the lowest-cost path to the root bridge. However, BPDU Guard triggers errdisable the moment a BPDU arrives, yanking the port out of service before STP can even assign a role. Additionally, root port selection depends on the BPDU's costs and switch IDs, not on the reception of a BPDU itself, so this option incorrectly implies an automatic role change.
When this WOULD be correct
In a different scenario where a switch is configured without BPDU Guard and is part of a larger network topology, a port could automatically become the root port if it is the lowest-cost path to the root bridge during the Spanning Tree Protocol (STP) convergence process.
- ✗
The port is converted into a trunk.
Why it's wrong here
A port becomes a trunk only through Dynamic Trunking Protocol (DTP) negotiation or explicit configuration, neither of which involves receiving spanning-tree BPDUs. The BPDU received is an STP bridge protocol data unit, not a DTP frame, so it cannot trigger trunk mode conversion. Furthermore, BPDU Guard reacts by error-disabling the port immediately, which preempts any possible DTP negotiation or trunk formation on that interface.
When this WOULD be correct
In a different scenario where a switch port is configured to allow trunking and is explicitly set to negotiate trunking with connected devices, a small unmanaged switch could potentially cause the port to convert to a trunk if it supports dynamic trunking protocols. The question would need to specify that trunking is enabled and that the connected device is capable of sending DTP messages.
- ✗
The port ignores the BPDU because PortFast disables STP entirely.
Why it's wrong here
PortFast does not disable Spanning Tree Protocol; it only transitions the port directly to the forwarding state on an access port, bypassing the listening and learning states. The switch still runs STP globally and will process BPDUs if they arrive at a PortFast-configured interface. BPDU Guard is a separate protection feature that specifically monitors for BPDUs and errdisables the port, so ignoring BPDUs would defeat that safeguard entirely.
When this WOULD be correct
In a different scenario where a switch port is configured with PortFast but not with BPDU Guard, a question could ask what happens when a small unmanaged switch sends BPDUs. In that case, the port would ignore the BPDUs and remain in the forwarding state, making this option correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The port is error-disabled by BPDU Guard.Correct answer▾
Why this is correct
BPDU Guard is a PortFast enhancement that places the port into the errdisable state whenever a BPDU is received on an edge port. Since PortFast assumes the port connects to an end host, any incoming BPDU signals a potential bridging loop or switch misconfiguration. The switch immediately shuts down the port to protect the spanning-tree topology, overriding any normal STP processing that might otherwise occur.
✗The port automatically becomes the root port.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because a port configured with PortFast and BPDU Guard will not automatically become the root port when it receives BPDUs; instead, it will be error-disabled due to BPDU Guard's protection mechanism.
★ When this WOULD be the correct answer
In a different scenario where a switch is configured without BPDU Guard and is part of a larger network topology, a port could automatically become the root port if it is the lowest-cost path to the root bridge during the Spanning Tree Protocol (STP) convergence process.
Why candidates choose this
Candidates may find this option tempting because they might confuse the behavior of STP with PortFast, thinking that the port's role in the STP topology can change dynamically based on BPDU reception.
✗The port is converted into a trunk.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because a port configured with PortFast does not automatically convert to a trunk port when it receives BPDUs; instead, it remains in access mode. BPDU Guard will cause the port to be error-disabled upon receiving BPDUs, preventing any trunking behavior.
★ When this WOULD be the correct answer
In a different scenario where a switch port is configured to allow trunking and is explicitly set to negotiate trunking with connected devices, a small unmanaged switch could potentially cause the port to convert to a trunk if it supports dynamic trunking protocols. The question would need to specify that trunking is enabled and that the connected device is capable of sending DTP messages.
Why candidates choose this
Candidates may find this option tempting because they might confuse the behavior of PortFast with trunking configurations, mistakenly believing that any BPDU received would trigger a trunk negotiation instead of causing the port to be error-disabled.
✗The port ignores the BPDU because PortFast disables STP entirely.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because PortFast does not disable Spanning Tree Protocol (STP) entirely; it merely allows the port to transition to the forwarding state immediately without participating in STP calculations. BPDUs are still processed, and BPDU Guard will take action if they are received.
★ When this WOULD be the correct answer
In a different scenario where a switch port is configured with PortFast but not with BPDU Guard, a question could ask what happens when a small unmanaged switch sends BPDUs. In that case, the port would ignore the BPDUs and remain in the forwarding state, making this option correct.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of PortFast's function, believing it completely disables STP and thus would not react to BPDUs, leading to the assumption that the port would ignore them.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Err-disabled
Err-disabled is a switch port state that occurs when the switch detects a critical error on that port and automatically shuts it down to protect the network.
Key term
BPDU Guard
BPDU Guard is a Cisco switch feature that protects the network from unauthorized devices by disabling a port if it receives a Bridge Protocol Data Unit (BPDU).
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.