CCNA Switching and Network Access Practice Question
A switch administrator enters the following commands on interface GigabitEthernet1/0/10:
interface g1/0/10 switchport mode access switchport access vlan 30 spanning-tree portfast spanning-tree bpduguard enable
A user connects a small managed switch to this port, and the access port immediately changes to an err-disabled state.
Which feature caused the port to shut down?
⚠ Common exam trap
Remember that BPDU Guard, not PortFast, causes a port to shut down when BPDUs are received. PortFast only affects port transition speed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BPDU Guard
BPDU Guard is the feature that caused the shutdown. This question is really about separating two features that are often configured together on user-facing ports: PortFast and BPDU Guard. PortFast helps an edge port come up quickly, which is useful for PCs and phones. BPDU Guard adds protection by watching for BPDUs on that same port. If a switch is connected where only an end device should exist, the newly connected switch may send BPDUs. The local switch interprets that as a topology risk and disables the port to protect the Layer 2 network. The clues are the err-disabled state and the fact that another switch was connected. VLAN assignment and access mode are normal here and do not explain the shutdown.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PortFast
Why it's wrong here
PortFast is related to the scenario, but it is not the feature that performs the protective shutdown. PortFast simply lets a user-facing port skip the usual long spanning-tree transition period so connected hosts can communicate sooner. In many networks it is paired with BPDU Guard, which is why candidates sometimes confuse the two. The actual disabling action comes from BPDU Guard after a BPDU is received.
When this WOULD be correct
In a different scenario, if the question asked about a port configured for PortFast that is connected to a device that sends BPDUs, the port could go into an err-disabled state due to BPDU Guard being enabled. In this case, PortFast would be the correct answer if the focus was on the immediate transition to forwarding.
- ✓
BPDU Guard
Why this is correct
Correct. BPDU Guard is correct because it is specifically designed to shut down an edge port that should not receive BPDUs. In plain terms, the switch sees evidence that another switch was attached and decides to protect the topology by disabling the port instead of allowing a possible loop or unexpected spanning-tree participation.
- ✗
Access VLAN 30 assignment
Why it's wrong here
Putting the port in VLAN 30 only decides which broadcast domain the user traffic belongs to. It does not create an err-disabled condition. A port can remain in an access VLAN indefinitely without shutting down. The shutdown happened because the connected device introduced switch control traffic, not because of the VLAN number chosen for the access port.
When this WOULD be correct
In a different scenario, if the question asked about a switch port configured to allow only specific VLANs and a device that sends traffic on a VLAN not permitted on that port is connected, the Access VLAN assignment could lead to issues. In such a case, the port might be disabled due to VLAN mismatches or misconfigurations.
- ✗
The interface being in access mode
Why it's wrong here
Access mode is a normal configuration for an end-device port. It tells the interface to carry one access VLAN rather than trunk multiple VLANs. That setting alone does not disable the interface. The decisive event in the scenario is that another switch sent a BPDU, which triggered the BPDU Guard protection mechanism.
When this WOULD be correct
In a different scenario where an exam question asks about the effects of configuring a switch port in access mode with specific VLAN assignments and other settings, a candidate might be asked to identify the potential issues caused by misconfigurations that could lead to err-disabled states. In such a case, if the question specified that the access mode was incorrectly configured for a trunking scenario, this option could be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓BPDU GuardCorrect answer▾
Why this is correct
Correct. BPDU Guard is correct because it is specifically designed to shut down an edge port that should not receive BPDUs. In plain terms, the switch sees evidence that another switch was attached and decides to protect the topology by disabling the port instead of allowing a possible loop or unexpected spanning-tree participation.
✗PortFastWrong answer — click to see why▾
Why this is wrong here
PortFast is a feature that allows a port to transition immediately to the forwarding state, bypassing the usual spanning-tree listening and learning phases. It does not cause a port to shut down or enter an err-disabled state; it only speeds up convergence for end-user devices.
★ When this WOULD be the correct answer
In a different scenario, if the question asked about a port configured for PortFast that is connected to a device that sends BPDUs, the port could go into an err-disabled state due to BPDU Guard being enabled. In this case, PortFast would be the correct answer if the focus was on the immediate transition to forwarding.
Why candidates choose this
Students often confuse PortFast with BPDU Guard because they are commonly configured together on edge ports. Since PortFast is involved in the scenario, it is tempting to think it is responsible for the shutdown, but the actual disabling action is performed by BPDU Guard.
✗Access VLAN 30 assignmentWrong answer — click to see why▾
Why this is wrong here
Assigning an access VLAN (VLAN 30) simply places the port into a specific broadcast domain for user traffic. It has no mechanism to detect or react to BPDUs, and it does not cause a port to enter an err-disabled state. The port would remain operational regardless of the VLAN assignment.
★ When this WOULD be the correct answer
In a different scenario, if the question asked about a switch port configured to allow only specific VLANs and a device that sends traffic on a VLAN not permitted on that port is connected, the Access VLAN assignment could lead to issues. In such a case, the port might be disabled due to VLAN mismatches or misconfigurations.
Why candidates choose this
A test-taker might think that the VLAN assignment could cause a conflict or misconfiguration leading to a shutdown, but VLAN assignment alone does not trigger any protective action. The confusion may arise from scenarios where VLAN mismatches cause issues, but those do not result in err-disabled state.
✗The interface being in access modeWrong answer — click to see why▾
Why this is wrong here
Configuring a port as an access port is a standard practice for connecting end devices. It does not inherently cause any shutdown or err-disabled condition. The port remains up and forwarding traffic unless another feature, such as BPDU Guard, triggers a protective action.
★ When this WOULD be the correct answer
In a different scenario where an exam question asks about the effects of configuring a switch port in access mode with specific VLAN assignments and other settings, a candidate might be asked to identify the potential issues caused by misconfigurations that could lead to err-disabled states. In such a case, if the question specified that the access mode was incorrectly configured for a trunking scenario, this option could be correct.
Why candidates choose this
Some students may think that access mode is restrictive and could cause issues when connecting a switch, but access mode simply disables trunking. The actual cause of the shutdown is the reception of a BPDU, which is detected by BPDU Guard, not by the access mode configuration.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
Switchport
A switchport is a physical or virtual interface on a network switch that connects devices like computers, printers, or other switches to a local area network.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.