Courseiva
← 200-301
Full test
Question 927 of 1,819
Switching and Network Access →mediumMultiple ChoiceObjective-mapped

CCNA Switching and Network Access Practice Question

This 200-301 practice question tests your understanding of switching and network access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: bPDU Guard detects Bridge Protocol Data Units (BPDUs) on ports configured as PortFast and immediately disables the port to prevent potential Layer 2 loops.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A switch administrator enters the following commands on interface GigabitEthernet1/0/10:

interface g1/0/10
 switchport mode access
 switchport access vlan 30
 spanning-tree portfast
 spanning-tree bpduguard enable

A user connects a small managed switch to this port, and the access port immediately changes to an err-disabled state.

Which feature caused the port to shut down?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

  • Clue: "immediately / without restart"

    Why it matters: Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.

Question 1mediummultiple choice
Open the full VLAN trunking answer →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

BPDU Guard

BPDU Guard is the feature that caused the shutdown. This question is really about separating two features that are often configured together on user-facing ports: PortFast and BPDU Guard. PortFast helps an edge port come up quickly, which is useful for PCs and phones. BPDU Guard adds protection by watching for BPDUs on that same port. If a switch is connected where only an end device should exist, the newly connected switch may send BPDUs. The local switch interprets that as a topology risk and disables the port to protect the Layer 2 network. The clues are the err-disabled state and the fact that another switch was connected. VLAN assignment and access mode are normal here and do not explain the shutdown.

Key principle: BPDU Guard detects Bridge Protocol Data Units (BPDUs) on ports configured as PortFast and immediately disables the port to prevent potential Layer 2 loops.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    PortFast

    Why it's wrong here

    PortFast is related to the scenario, but it is not the feature that performs the protective shutdown. PortFast simply lets a user-facing port skip the usual long spanning-tree transition period so connected hosts can communicate sooner. In many networks it is paired with BPDU Guard, which is why candidates sometimes confuse the two. The actual disabling action comes from BPDU Guard after a BPDU is received.

    When this WOULD be correct

    In a different scenario, if the question asked about a port configured for PortFast that is connected to a device that sends BPDUs, the port could go into an err-disabled state due to BPDU Guard being enabled. In this case, PortFast would be the correct answer if the focus was on the immediate transition to forwarding.

  • ✓

    BPDU Guard

    Why this is correct

    Correct. BPDU Guard is correct because it is specifically designed to shut down an edge port that should not receive BPDUs. In plain terms, the switch sees evidence that another switch was attached and decides to protect the topology by disabling the port instead of allowing a possible loop or unexpected spanning-tree participation.

    Clue confirmation

    The clue word "immediately / without restart" in the question point toward this answer.

    Related concept

    BPDU Guard detects Bridge Protocol Data Units (BPDUs) on ports configured as PortFast and immediately disables the port to prevent potential Layer 2 loops.

  • ✗

    Access VLAN 30 assignment

    Why it's wrong here

    Putting the port in VLAN 30 only decides which broadcast domain the user traffic belongs to. It does not create an err-disabled condition. A port can remain in an access VLAN indefinitely without shutting down. The shutdown happened because the connected device introduced switch control traffic, not because of the VLAN number chosen for the access port.

    When this WOULD be correct

    In a different scenario, if the question asked about a switch port configured to allow only specific VLANs and a device that sends traffic on a VLAN not permitted on that port is connected, the Access VLAN assignment could lead to issues. In such a case, the port might be disabled due to VLAN mismatches or misconfigurations.

  • ✗

    The interface being in access mode

    Why it's wrong here

    Access mode is a normal configuration for an end-device port. It tells the interface to carry one access VLAN rather than trunk multiple VLANs. That setting alone does not disable the interface. The decisive event in the scenario is that another switch sent a BPDU, which triggered the BPDU Guard protection mechanism.

    When this WOULD be correct

    In a different scenario where an exam question asks about the effects of configuring a switch port in access mode with specific VLAN assignments and other settings, a candidate might be asked to identify the potential issues caused by misconfigurations that could lead to err-disabled states. In such a case, if the question specified that the access mode was incorrectly configured for a trunking scenario, this option could be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

✓BPDU GuardCorrect answer▾

Why this is correct

Correct. BPDU Guard is correct because it is specifically designed to shut down an edge port that should not receive BPDUs. In plain terms, the switch sees evidence that another switch was attached and decides to protect the topology by disabling the port instead of allowing a possible loop or unexpected spanning-tree participation.

✗PortFastWrong answer — click to see why▾

Why this is wrong here

PortFast is a feature that allows a port to transition immediately to the forwarding state, bypassing the usual spanning-tree listening and learning phases. It does not cause a port to shut down or enter an err-disabled state; it only speeds up convergence for end-user devices.

★ When this WOULD be the correct answer

In a different scenario, if the question asked about a port configured for PortFast that is connected to a device that sends BPDUs, the port could go into an err-disabled state due to BPDU Guard being enabled. In this case, PortFast would be the correct answer if the focus was on the immediate transition to forwarding.

Why candidates choose this

Students often confuse PortFast with BPDU Guard because they are commonly configured together on edge ports. Since PortFast is involved in the scenario, it is tempting to think it is responsible for the shutdown, but the actual disabling action is performed by BPDU Guard.

✗Access VLAN 30 assignmentWrong answer — click to see why▾

Why this is wrong here

Assigning an access VLAN (VLAN 30) simply places the port into a specific broadcast domain for user traffic. It has no mechanism to detect or react to BPDUs, and it does not cause a port to enter an err-disabled state. The port would remain operational regardless of the VLAN assignment.

★ When this WOULD be the correct answer

In a different scenario, if the question asked about a switch port configured to allow only specific VLANs and a device that sends traffic on a VLAN not permitted on that port is connected, the Access VLAN assignment could lead to issues. In such a case, the port might be disabled due to VLAN mismatches or misconfigurations.

Why candidates choose this

A test-taker might think that the VLAN assignment could cause a conflict or misconfiguration leading to a shutdown, but VLAN assignment alone does not trigger any protective action. The confusion may arise from scenarios where VLAN mismatches cause issues, but those do not result in err-disabled state.

✗The interface being in access modeWrong answer — click to see why▾

Why this is wrong here

Configuring a port as an access port is a standard practice for connecting end devices. It does not inherently cause any shutdown or err-disabled condition. The port remains up and forwarding traffic unless another feature, such as BPDU Guard, triggers a protective action.

★ When this WOULD be the correct answer

In a different scenario where an exam question asks about the effects of configuring a switch port in access mode with specific VLAN assignments and other settings, a candidate might be asked to identify the potential issues caused by misconfigurations that could lead to err-disabled states. In such a case, if the question specified that the access mode was incorrectly configured for a trunking scenario, this option could be correct.

Why candidates choose this

Some students may think that access mode is restrictive and could cause issues when connecting a switch, but access mode simply disables trunking. The actual cause of the shutdown is the reception of a BPDU, which is detected by BPDU Guard, not by the access mode configuration.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Common exam traps

Common exam trap: answer the scenario, not the keyword

Remember that BPDU Guard, not PortFast, causes a port to shut down when BPDUs are received. PortFast only affects port transition speed.

Trap categories for this question

  • Similar concept trap

    PortFast is related to the scenario, but it is not the feature that performs the protective shutdown. PortFast simply lets a user-facing port skip the usual long spanning-tree transition period so connected hosts can communicate sooner. In many networks it is paired with BPDU Guard, which is why candidates sometimes confuse the two. The actual disabling action comes from BPDU Guard after a BPDU is received.

  • Scenario analysis trap

    PortFast is related to the scenario, but it is not the feature that performs the protective shutdown. PortFast simply lets a user-facing port skip the usual long spanning-tree transition period so connected hosts can communicate sooner. In many networks it is paired with BPDU Guard, which is why candidates sometimes confuse the two. The actual disabling action comes from BPDU Guard after a BPDU is received.

Detailed technical explanation

How to think about this question

BPDU Guard is a Cisco feature designed to protect the Spanning Tree Protocol (STP) topology by disabling ports that receive unexpected Bridge Protocol Data Units (BPDUs). Typically, ports connected to end devices like PCs or printers are configured with PortFast to skip the STP listening and learning states, allowing faster network access. However, if a switch or another device that sends BPDUs is connected to such a port, it can cause topology loops or instability. BPDU Guard detects this condition and immediately places the port into an err-disabled state to prevent potential network issues. When BPDU Guard is enabled on a PortFast-configured access port, the switch continuously monitors for incoming BPDUs. If any BPDU is detected, the port is considered to be connected to another switch or a device that could affect the spanning tree topology. To protect the network, BPDU Guard shuts down the port by placing it in an err-disabled state, requiring manual or automatic recovery depending on the configuration. This behavior ensures that only legitimate end devices connect to these ports, maintaining network stability and preventing loops. A common exam trap is confusing PortFast with BPDU Guard. While PortFast speeds up port activation for end devices, it does not disable ports upon receiving BPDUs. BPDU Guard is the feature that enforces topology protection by shutting down ports receiving BPDUs unexpectedly. In practical networks, connecting an unmanaged switch to a PortFast and BPDU Guard-enabled port triggers BPDU Guard, causing the port to err-disable. Understanding this distinction is critical for CCNA candidates to correctly identify the cause of port shutdowns in STP-related scenarios.

KKey Concepts to Remember

  • BPDU Guard detects Bridge Protocol Data Units (BPDUs) on ports configured as PortFast and immediately disables the port to prevent potential Layer 2 loops.
  • PortFast allows a switch port to bypass the usual Spanning Tree Protocol (STP) listening and learning states, enabling faster host connectivity without causing topology changes.
  • An access port assigned to a VLAN forwards traffic only for that VLAN but does not inherently cause the port to shut down or enter err-disabled state.
  • When BPDU Guard is enabled on a PortFast-enabled port, receipt of any BPDU triggers an err-disabled state to protect the network topology from unauthorized switches.
  • A port in access mode carries traffic for a single VLAN and does not participate in STP topology changes unless BPDUs are received and BPDU Guard is active.
  • The err-disabled state is a protective mechanism that disables a port after detecting a violation such as receiving unexpected BPDUs on an edge port.
  • BPDU Guard is designed to protect the network by shutting down ports that should only connect to end devices, preventing accidental or malicious switch connections.
  • PortFast and BPDU Guard are often configured together on user-facing ports to speed up host connectivity while safeguarding the spanning tree topology.

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

BPDU Guard detects Bridge Protocol Data Units (BPDUs) on ports configured as PortFast and immediately disables the port to prevent potential Layer 2 loops.

Real-world example

How this comes up in practice

A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.

What to study next

Got this wrong? Here's your next step.

Review bPDU Guard detects Bridge Protocol Data Units (BPDUs) on ports configured as PortFast and immediately disables the port to prevent potential Layer 2 loops., then practise related 200-301 questions on the same topic to reinforce the concept.

Related practice questions

Related 200-301 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Network Infrastructure and Connectivity practice questions

Practise 200-301 questions linked to Network Infrastructure and Connectivity.

Switching and Network Access practice questions

Practise 200-301 questions linked to Switching and Network Access.

IP Routing practice questions

Practise 200-301 questions linked to IP Routing.

Network Services and Security practice questions

Practise 200-301 questions linked to Network Services and Security.

AI and Network Operations practice questions

Practise 200-301 questions linked to AI and Network Operations.

CCNA subnetting practice questions

Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.

CCNA OSPF practice questions

Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.

CCNA VLAN practice questions

Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.

CCNA STP practice questions

Practise spanning tree, root bridge election, port roles and STP troubleshooting.

CCNA EtherChannel practice questions

Practise LACP, PAgP, port-channel behaviour and bundle requirements.

CCNA ACL practice questions

Practise standard and extended ACLs, permit/deny logic and traffic filtering.

CCNA NAT practice questions

Practise static NAT, dynamic NAT, PAT and inside/outside address translation.

Practice this exam

Start a free 200-301 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions20 questions30 questions50 questionsTimed 30
200-301 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this 200-301 question test?

Switching and Network Access — This question tests Switching and Network Access — BPDU Guard detects Bridge Protocol Data Units (BPDUs) on ports configured as PortFast and immediately disables the port to prevent potential Layer 2 loops..

What is the correct answer to this question?

The correct answer is: BPDU Guard — BPDU Guard is the feature that caused the shutdown. This question is really about separating two features that are often configured together on user-facing ports: PortFast and BPDU Guard. PortFast helps an edge port come up quickly, which is useful for PCs and phones. BPDU Guard adds protection by watching for BPDUs on that same port. If a switch is connected where only an end device should exist, the newly connected switch may send BPDUs. The local switch interprets that as a topology risk and disables the port to protect the Layer 2 network. The clues are the err-disabled state and the fact that another switch was connected. VLAN assignment and access mode are normal here and do not explain the shutdown.

What should I do if I get this 200-301 question wrong?

Review bPDU Guard detects Bridge Protocol Data Units (BPDUs) on ports configured as PortFast and immediately disables the port to prevent potential Layer 2 loops., then practise related 200-301 questions on the same topic to reinforce the concept.

Are there clue words in this question I should notice?

Yes — watch for: "immediately / without restart". Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.

What is the key concept behind this question?

BPDU Guard detects Bridge Protocol Data Units (BPDUs) on ports configured as PortFast and immediately disables the port to prevent potential Layer 2 loops.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

More 200-301 practice questions

Browse all 200-301 questions →

Last reviewed: May 17, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Sign in to join the discussion.

This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.