CCNA Network Services and Security Practice Question
A switch should disable an edge port immediately if a BPDU is received on it. Which feature is intended for that specific behavior?
⚠ Common exam trap
A common exam trap is confusing BPDU Guard with Root Guard or Loop Guard. Candidates may incorrectly select Root Guard because it also deals with BPDUs, but Root Guard only blocks ports from becoming root ports and does not disable the port immediately. Loop Guard protects against unidirectional link failures and does not shut down ports upon BPDU receipt. Another mistake is thinking UDLD handles BPDU protection; however, UDLD only detects unidirectional physical link failures and is unrelated to STP BPDU processing. Understanding that BPDU Guard uniquely disables edge ports upon BPDU detection is critical to avoid this trap.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BPDU Guard
The feature is BPDU Guard. In plain language, the administrator is treating the port as an end-device-only edge interface and wants the switch to react aggressively if it ever sees spanning-tree control traffic there. BPDU Guard does exactly that: if a BPDU appears on a protected edge port, the switch places the interface into an err-disabled state to help prevent accidental loops or rogue switch connections. This is different from root guard and loop guard, which solve other spanning-tree control problems. BPDU Guard is the specific answer when the requirement is “if you ever hear a BPDU here, shut the port down quickly.”
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
BPDU Guard
Why this is correct
BPDU Guard is correct because it is specifically designed to protect edge ports configured with PortFast. When a BPDU is received on such a port, BPDU Guard immediately places the port into the error-disabled state, preventing an unexpected switch from creating a Layer 2 loop. This action is immediate and automatic, requiring manual re-enabling or errdisable auto-recovery, which matches the behavior described in the question.
- ✗
Loop Guard
Why it's wrong here
Loop Guard is incorrect because it addresses the opposite condition: it protects against the absence of BPDUs, not their presence. When a root or alternate port stops receiving BPDUs due to a unidirectional link or hardware failure, Loop Guard places the port into an inconsistent state to prevent it from moving to forwarding. It does not take any action when a BPDU is received, so it cannot disable an edge port immediately upon BPDU arrival.
When this WOULD be correct
If the question asked about a feature that prevents loops by blocking ports that receive unexpected BPDUs, then Loop Guard would be the correct answer. For example, a question could specify a scenario where a switch is configured to maintain a loop-free topology.
- ✗
Root Guard
Why it's wrong here
Root Guard is incorrect because it only reacts to superior BPDUs that would persuade the port to become a root port, not to any BPDU at all. If such a BPDU is received, Root Guard transitions the port to a root-inconsistent state, blocking traffic only while the superior BPDU is present. This mechanism is meant to enforce root bridge placement, not to disable an access edge port, and it does not meet the requirement to disable the port immediately on any BPDU.
When this WOULD be correct
In a scenario where the question asks about preventing a port from becoming a root port in a network with multiple switches, and emphasizes maintaining the intended root bridge, Root Guard would be the correct answer. For example, a question might state that a network administrator wants to ensure that only designated switches can become the root bridge.
- ✗
UDLD
Why it's wrong here
UDLD is incorrect because its purpose is to detect unidirectional links, which occur when a link can transmit frames in one direction but not the other. UDLD sends its own protocol messages and monitors their echo to verify bidirectional connectivity, but it does not inspect BPDUs or respond to their arrival. Consequently, receiving a BPDU on an edge port would not trigger UDLD to disable that port.
When this WOULD be correct
If the question asked about a feature that detects unidirectional links and prevents loops in a network, then UDLD would be the correct answer. For example, a scenario could involve a network design question where ensuring bidirectional communication is critical.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓BPDU GuardCorrect answer▾
Why this is correct
BPDU Guard is correct because it is specifically designed to protect edge ports configured with PortFast. When a BPDU is received on such a port, BPDU Guard immediately places the port into the error-disabled state, preventing an unexpected switch from creating a Layer 2 loop. This action is immediate and automatic, requiring manual re-enabling or errdisable auto-recovery, which matches the behavior described in the question.
✗Loop GuardWrong answer — click to see why▾
Why this is wrong here
Loop Guard is designed to prevent loops on a network by blocking ports that receive BPDUs when they are not expected. It does not disable an edge port immediately upon receiving a BPDU, which is the specific behavior described in the question.
★ When this WOULD be the correct answer
If the question asked about a feature that prevents loops by blocking ports that receive unexpected BPDUs, then Loop Guard would be the correct answer. For example, a question could specify a scenario where a switch is configured to maintain a loop-free topology.
Why candidates choose this
Candidates may choose Loop Guard because they understand it relates to BPDU handling and network stability, leading to confusion with the specific requirement of disabling an edge port immediately.
✗Root GuardWrong answer — click to see why▾
Why this is wrong here
Root Guard is designed to prevent a port from becoming a root port if a superior BPDU is received, but it does not disable the port immediately like BPDU Guard does. It only restricts the port's role in the spanning tree.
★ When this WOULD be the correct answer
In a scenario where the question asks about preventing a port from becoming a root port in a network with multiple switches, and emphasizes maintaining the intended root bridge, Root Guard would be the correct answer. For example, a question might state that a network administrator wants to ensure that only designated switches can become the root bridge.
Why candidates choose this
Candidates may confuse Root Guard with BPDU Guard due to both features dealing with BPDUs and spanning tree protocols, leading them to incorrectly associate Root Guard with immediate port disabling.
✗UDLDWrong answer — click to see why▾
Why this is wrong here
UDLD (Unidirectional Link Detection) is used to detect unidirectional links and prevent traffic loss but does not disable an edge port upon receiving a BPDU. It focuses on link integrity rather than BPDU handling.
★ When this WOULD be the correct answer
If the question asked about a feature that detects unidirectional links and prevents loops in a network, then UDLD would be the correct answer. For example, a scenario could involve a network design question where ensuring bidirectional communication is critical.
Why candidates choose this
Candidates may confuse UDLD with features related to loop prevention and port protection, leading them to mistakenly believe it addresses BPDU reception issues.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
Loops
A loop is a programming construct that repeats a block of code multiple times until a certain condition is met or until all items in a collection have been processed.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.