CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: bPDU Guard disables a switch port by placing it into an err-disabled state if the port receives any BPDU frames, protecting the STP topology.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A switch should automatically disable any access port that receives a BPDU from an attached device. Which feature directly provides that behavior?
Why wrong: Root Guard prevents a port from becoming a root port if superior BPDUs are received, but it does not simply err-disable edge ports on any BPDU.
B
Loop Guard
Why wrong: Loop Guard protects against unidirectional-link conditions on non-designated STP ports.
C
BPDU Guard
BPDU Guard disables an edge port if it receives a BPDU.
D
PortFast
Why wrong: PortFast accelerates transition to forwarding; it does not by itself shut down on BPDUs.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BPDU Guard
BPDU Guard is designed for edge ports that should never see BPDUs. If a BPDU arrives, the port is placed into an err-disabled state to protect the topology. Root Guard and Loop Guard solve different STP problems.
Key principle: BPDU Guard disables a switch port by placing it into an err-disabled state if the port receives any BPDU frames, protecting the STP topology.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Root Guard
Why it's wrong here
Root Guard prevents a port from becoming a root port if superior BPDUs are received, but it does not simply err-disable edge ports on any BPDU.
When this WOULD be correct
If the exam question asked about a feature that prevents a switch port from becoming a root port and maintains the integrity of the spanning tree by blocking ports that receive BPDUs from non-root bridges, then Root Guard would be the correct answer.
✗
Loop Guard
Why it's wrong here
Loop Guard protects against unidirectional-link conditions on non-designated STP ports.
When this WOULD be correct
If the exam question asked about a feature that prevents loops by blocking ports that receive unexpected BPDUs, Loop Guard would be the correct answer. For example, a question could specify a scenario where a switch needs to maintain a loop-free topology in a redundant network setup.
✓
BPDU Guard
Why this is correct
BPDU Guard disables an edge port if it receives a BPDU.
Related concept
BPDU Guard disables a switch port by placing it into an err-disabled state if the port receives any BPDU frames, protecting the STP topology.
✗
PortFast
Why it's wrong here
PortFast accelerates transition to forwarding; it does not by itself shut down on BPDUs.
When this WOULD be correct
If the question asked about a feature that enhances the speed of port activation without considering BPDU reception, such as 'Which feature allows a switch port to immediately enter the forwarding state?' then PortFast would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓BPDU GuardCorrect answer▾
Why this is correct
BPDU Guard disables an edge port if it receives a BPDU.
✗Root GuardWrong answer — click to see why▾
Why this is wrong here
Root Guard is designed to prevent a port from becoming a root port if it receives a BPDU from a non-root bridge, but it does not disable the port itself upon receiving a BPDU. Therefore, it does not fulfill the requirement of automatically disabling access ports upon BPDU reception.
★ When this WOULD be the correct answer
If the exam question asked about a feature that prevents a switch port from becoming a root port and maintains the integrity of the spanning tree by blocking ports that receive BPDUs from non-root bridges, then Root Guard would be the correct answer.
Why candidates choose this
Candidates may confuse Root Guard with BPDU Guard due to their similar names and both being related to spanning tree protocol protection mechanisms, leading them to incorrectly assume Root Guard provides the desired behavior.
✗Loop GuardWrong answer — click to see why▾
Why this is wrong here
Loop Guard is designed to prevent loops on a network by blocking ports that receive BPDUs when they should not, but it does not disable access ports that receive BPDUs from attached devices. Therefore, it does not fulfill the requirement of automatically disabling the port.
★ When this WOULD be the correct answer
If the exam question asked about a feature that prevents loops by blocking ports that receive unexpected BPDUs, Loop Guard would be the correct answer. For example, a question could specify a scenario where a switch needs to maintain a loop-free topology in a redundant network setup.
Why candidates choose this
Candidates may confuse Loop Guard with BPDU Guard due to their similar names and functions related to BPDUs, leading them to incorrectly associate Loop Guard with the behavior of disabling ports upon receiving BPDUs.
✗PortFastWrong answer — click to see why▾
Why this is wrong here
PortFast is designed to allow a switch port to transition directly to the forwarding state, bypassing the listening and learning states, but it does not disable the port upon receiving a BPDU. Therefore, it does not provide the behavior described in the question.
★ When this WOULD be the correct answer
If the question asked about a feature that enhances the speed of port activation without considering BPDU reception, such as 'Which feature allows a switch port to immediately enter the forwarding state?' then PortFast would be the correct answer.
Why candidates choose this
Candidates may confuse PortFast with BPDU Guard due to their association with port states and rapid convergence, leading them to mistakenly believe that PortFast also handles BPDU reception.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
A common exam trap is confusing BPDU Guard with Root Guard or Loop Guard. Candidates may incorrectly select Root Guard because it involves BPDUs and port blocking, but Root Guard only prevents a port from becoming a root port and does not err-disable the port. Loop Guard is often mistaken as it protects against unidirectional link failures but does not disable ports on BPDU receipt. The key distinction is that BPDU Guard immediately disables the port upon receiving any BPDU, which is the behavior the question describes. Misunderstanding these differences can lead to incorrect answers.
Detailed technical explanation
How to think about this question
BPDU Guard is a Cisco switch feature designed to protect the Spanning Tree Protocol (STP) topology by disabling ports that receive unexpected Bridge Protocol Data Units (BPDUs). BPDUs are frames exchanged between switches to detect loops and maintain a loop-free Layer 2 topology. Edge ports, typically connected to end devices like PCs or printers, should not receive BPDUs because these devices do not participate in STP. BPDU Guard enforces this by err-disabling any port that receives a BPDU, preventing potential topology changes or loops caused by misconfigurations or malicious devices.
When BPDU Guard is enabled on a port configured with PortFast, the switch monitors incoming frames for BPDUs. If a BPDU is detected on that port, the switch immediately places the port into an err-disabled state, effectively shutting it down to protect the network. This behavior is crucial in environments where edge ports should never participate in STP, ensuring that no rogue switches or miswired devices can influence the spanning tree topology. Other STP protection features like Root Guard and Loop Guard serve different purposes and do not err-disable ports upon receiving BPDUs.
A common exam trap is confusing BPDU Guard with Root Guard or Loop Guard. Root Guard prevents a port from becoming a root port if superior BPDUs are received but does not disable the port. Loop Guard protects against unidirectional link failures on non-designated ports but also does not err-disable ports on BPDU receipt. Understanding that BPDU Guard specifically disables edge ports on BPDU receipt is key to answering questions about protecting STP edge ports and maintaining topology stability in Cisco networks.
KKey Concepts to Remember
BPDU Guard disables a switch port by placing it into an err-disabled state if the port receives any BPDU frames, protecting the STP topology.
Edge ports configured with PortFast should have BPDU Guard enabled to prevent accidental or malicious introduction of switches into the network.
Root Guard prevents a port from becoming a root port when superior BPDUs are received but does not disable the port upon BPDU receipt.
Loop Guard protects against unidirectional link failures on non-designated STP ports but does not err-disable ports on BPDU reception.
Ports with BPDU Guard enabled immediately shut down upon receiving BPDUs, preventing potential Layer 2 loops or topology changes.
BPDU Guard is essential for securing access layer ports that connect to end devices, ensuring they do not participate in STP.
A port placed into an err-disabled state by BPDU Guard requires manual intervention or errdisable recovery to be re-enabled.
Enabling BPDU Guard on PortFast ports helps maintain network stability by preventing rogue switches from affecting the spanning tree.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
BPDU Guard disables a switch port by placing it into an err-disabled state if the port receives any BPDU frames, protecting the STP topology.
Real-world example
How this comes up in practice
A practitioner preparing for the 200-301 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. BPDU Guard disables a switch port by placing it into an err-disabled state if the port receives any BPDU frames, protecting the STP topology. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review bPDU Guard disables a switch port by placing it into an err-disabled state if the port receives any BPDU frames, protecting the STP topology., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — This question tests Network Services and Security — BPDU Guard disables a switch port by placing it into an err-disabled state if the port receives any BPDU frames, protecting the STP topology..
What is the correct answer to this question?
The correct answer is: BPDU Guard — BPDU Guard is designed for edge ports that should never see BPDUs. If a BPDU arrives, the port is placed into an err-disabled state to protect the topology. Root Guard and Loop Guard solve different STP problems.
What should I do if I get this 200-301 question wrong?
Review bPDU Guard disables a switch port by placing it into an err-disabled state if the port receives any BPDU frames, protecting the STP topology., then practise related 200-301 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
BPDU Guard disables a switch port by placing it into an err-disabled state if the port receives any BPDU frames, protecting the STP topology.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.