CCNA Switching and Network Access Practice Question
A switch receives superior BPDUs on a port where the design requires that no downstream device ever become the root path for that segment. Which feature is the best fit for that requirement?
⚠ Common exam trap
A common exam trap is selecting BPDU guard instead of root guard because both involve BPDU handling. BPDU guard disables a port immediately upon receiving any BPDU, which is suitable for edge ports but not for ports where topology control is required. Root guard, on the other hand, only blocks ports that receive superior BPDUs, allowing normal BPDUs from the current root bridge. Confusing these features can lead to incorrect answers, as BPDU guard does not protect the root path role but rather protects against unauthorized devices on edge ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Root guard
Root guard is the best fit because it is designed to prevent a port from becoming the path toward a new root bridge when superior BPDUs are received. In practical terms, it protects the intended STP topology by keeping that port from taking on a root-related forwarding role when the design says it should not. This is different from BPDU Guard, which is more commonly used on edge ports to disable them entirely if BPDUs appear. Root guard is about protecting topology roles, not just edge-port assumptions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Root guard
Why this is correct
Root guard is the correct STP protection mechanism for this scenario. When a port configured with root guard receives a superior BPDU (one advertising a better bridge ID or lower root path cost), it transitions the port to a root-inconsistent state, effectively blocking it. This prevents the port from becoming a root port and stops an unauthorized switch from hijacking the root bridge role, thereby preserving the intended spanning-tree topology.
- ✗
BPDU Guard
Why it's wrong here
BPDU Guard is designed for PortFast-enabled edge ports, such as those connecting to end hosts, and it reacts to the presence of any BPDU, not specifically a superior one. If a BPDU arrives, BPDU Guard immediately shuts down the port (error-disables it) to prevent accidental loops. In the described case, the port is not an edge port but a designated port expecting legitimate BPDUs, so BPDU Guard would not provide the correct protective behavior; it would either be irrelevant or cause an unnecessary shutdown.
When this WOULD be correct
In a scenario where the question asks about protecting edge ports from receiving BPDUs while allowing them to remain operational, BPDU Guard would be the correct answer. For example, if the question specified that the goal was to prevent accidental topology changes on access ports, BPDU Guard would fit.
- ✗
Port security
Why it's wrong here
Port security operates at the access layer to enforce a permitted set of MAC addresses on a switchport, blocking frames from unknown sources. It has no relationship with Spanning Tree Protocol or BPDU processing—it does not evaluate BPDU priority or root-path metrics. Therefore, receiving superior BPDUs would be completely unaffected by port security configuration, making it an incorrect solution for preventing an unwanted root bridge takeover.
When this WOULD be correct
In a scenario where the question asks about securing a switch port against unauthorized devices connecting, while ensuring that only specific MAC addresses are allowed, port security would be the correct answer. This could involve a network segment where only known devices should be permitted to communicate.
- ✗
DHCP Snooping
Why it's wrong here
DHCP Snooping is a Layer 2 security feature that filters DHCP traffic based on whether a port is trusted or untrusted, primarily to block rogue DHCP servers. It does not inspect or act on Spanning Tree Protocol messages, nor does it influence the selection of root bridges or root ports. A superior BPDU arriving on a port is an STP event, so DHCP Snooping cannot mitigate the resulting root-path change, making it wholly unrelated to the problem.
When this WOULD be correct
In a scenario where a question asks about securing a network against rogue DHCP servers and ensuring that only trusted DHCP servers can assign IP addresses, DHCP Snooping would be the correct answer. This would involve configuring the switch to allow DHCP responses only from specific trusted ports.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Root guardCorrect answer▾
Why this is correct
Root guard is the correct STP protection mechanism for this scenario. When a port configured with root guard receives a superior BPDU (one advertising a better bridge ID or lower root path cost), it transitions the port to a root-inconsistent state, effectively blocking it. This prevents the port from becoming a root port and stops an unauthorized switch from hijacking the root bridge role, thereby preserving the intended spanning-tree topology.
✗BPDU GuardWrong answer — click to see why▾
Why this is wrong here
BPDU Guard is designed to protect against receiving BPDUs on ports configured as edge ports, but it does not prevent a downstream device from becoming the root bridge. It simply disables the port if a BPDU is received, which does not align with the requirement of preventing a downstream device from becoming the root path.
★ When this WOULD be the correct answer
In a scenario where the question asks about protecting edge ports from receiving BPDUs while allowing them to remain operational, BPDU Guard would be the correct answer. For example, if the question specified that the goal was to prevent accidental topology changes on access ports, BPDU Guard would fit.
Why candidates choose this
Candidates may confuse BPDU Guard with Root Guard due to their similar functions in protecting the network topology, leading them to mistakenly believe that BPDU Guard can also prevent a downstream device from becoming the root bridge.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security is used to restrict the number of MAC addresses allowed on a port and prevent unauthorized devices from connecting. It does not specifically prevent a downstream device from becoming the root bridge in a Spanning Tree Protocol (STP) topology.
★ When this WOULD be the correct answer
In a scenario where the question asks about securing a switch port against unauthorized devices connecting, while ensuring that only specific MAC addresses are allowed, port security would be the correct answer. This could involve a network segment where only known devices should be permitted to communicate.
Why candidates choose this
Candidates may confuse port security with STP features, thinking that limiting MAC addresses could also prevent topology changes. This misunderstanding can lead them to select port security when they are actually looking for a solution related to STP behavior.
✗DHCP SnoopingWrong answer — click to see why▾
Why this is wrong here
DHCP Snooping is designed to prevent unauthorized DHCP servers from distributing IP addresses on a network, not to manage or control the role of switches in the Spanning Tree Protocol (STP). In this context, it does not address the requirement of preventing downstream devices from becoming the root bridge.
★ When this WOULD be the correct answer
In a scenario where a question asks about securing a network against rogue DHCP servers and ensuring that only trusted DHCP servers can assign IP addresses, DHCP Snooping would be the correct answer. This would involve configuring the switch to allow DHCP responses only from specific trusted ports.
Why candidates choose this
Candidates might confuse DHCP Snooping with general network security features, thinking it could relate to controlling device roles in STP due to its focus on preventing unauthorized access, leading them to mistakenly select it.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
BPDU Guard
BPDU Guard is a Cisco switch feature that protects the network from unauthorized devices by disabling a port if it receives a Bridge Protocol Data Unit (BPDU).
Key term
Bridge Protocol Data Unit
A Bridge Protocol Data Unit (BPDU) is a special message that network switches exchange to detect and prevent loops in an Ethernet network.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.