CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Root Guard

  Why it's wrong here

  Root Guard is incorrect because its purpose is to maintain the position of the root bridge by preventing a port from becoming a root port. When a superior BPDU is received, Root Guard places the port in a root-inconsistent state rather than err-disabling it, and only if the port is not designated for the root. It does not automatically disable an access port on any BPDU; instead, it filters superior BPDUs to protect the existing root topology.

  When this WOULD be correct

  If the exam question asked about a feature that prevents a switch port from becoming a root port and maintains the integrity of the spanning tree by blocking ports that receive BPDUs from non-root bridges, then Root Guard would be the correct answer.

• ✗

  Loop Guard

  Why it's wrong here

  Loop Guard is incorrect because it protects against unidirectional link failures by monitoring the absence of BPDUs on non-designated ports, not the presence of BPDUs on access ports. When a port stops receiving BPDUs due to a unidirectional link, Loop Guard places the port in an inconsistent state to prevent loops. It does not disable an access port upon receiving a BPDU; its trigger is missing BPDUs, not received ones.

  When this WOULD be correct

  If the exam question asked about a feature that prevents loops by blocking ports that receive unexpected BPDUs, Loop Guard would be the correct answer. For example, a question could specify a scenario where a switch needs to maintain a loop-free topology in a redundant network setup.

• ✓

  BPDU Guard

  Why this is correct

  BPDU Guard is the correct answer because it is specifically designed to protect access ports, which should operate as edge ports in a spanning-tree domain. When an access port with BPDU Guard enabled receives any BPDU, the switch immediately places the port into the err-disabled state, effectively shutting it down to prevent a potential switching loop or unauthorized switch connection. This behavior directly matches the requirement of automatically disabling an access port that receives BPDUs.

• ✗

  PortFast

  Why it's wrong here

  PortFast is incorrect because it only accelerates the transition of a port from blocking to forwarding by skipping the listening and learning states. It does not monitor for incoming BPDUs nor does it disable the port when a BPDU is received. PortFast simply assumes the port is connected to an end host, but it lacks any enforcement mechanism to shut down the port on unexpected BPDUs.

  When this WOULD be correct

  If the question asked about a feature that enhances the speed of port activation without considering BPDU reception, such as 'Which feature allows a switch port to immediately enter the forwarding state?' then PortFast would be the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”