The answer is spanning-tree portfast and BPDU Guard. PortFast immediately transitions an access port to the forwarding state, bypassing the listening and learning phases so an endpoint like a PC can connect without delay, while BPDU Guard monitors for incoming Bridge Protocol Data Units and err-disables the port the moment any BPDU is received, which would indicate an unauthorized switch connection. On the CCNA 200-301 v2 exam, this pairing tests your understanding of STP edge port security—a common trap is assuming PortFast alone prevents loops, but it only speeds convergence; BPDU Guard is the enforcement mechanism that actually shuts the port down. A solid memory tip is “Fast to forward, Guard to guard”: PortFast gets the endpoint online fast, and BPDU Guard guards against rogue switches by triggering err-disable.
CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: spanning-tree PortFast immediately transitions a switchport to the forwarding state, allowing end devices to connect without delay during STP convergence.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A switchport connected to an employee PC must allow the normal endpoint to connect but immediately err-disable the port if a switch is plugged in. Which two features should be configured on that access port?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "immediately / without restart"
Why it matters: Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
spanning-tree bpduguard enable
For edge access ports, PortFast brings the port up quickly for end devices, and BPDU Guard protects against someone connecting a switch by err-disabling the interface when BPDUs arrive.
Key principle: Spanning-tree PortFast immediately transitions a switchport to the forwarding state, allowing end devices to connect without delay during STP convergence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
spanning-tree bpduguard enable
Why this is correct
BPDU Guard shuts down an access port that unexpectedly receives BPDUs from another switch.
Clue confirmation
The clue word "immediately / without restart" in the question point toward this answer.
Related concept
Spanning-tree PortFast immediately transitions a switchport to the forwarding state, allowing end devices to connect without delay during STP convergence.
✗
switchport port-security maximum 1
Why it's wrong here
This limits MAC addresses but does not specifically detect a switch uplink.
The clue word "immediately / without restart" in the question point toward this answer.
Related concept
Spanning-tree PortFast immediately transitions a switchport to the forwarding state, allowing end devices to connect without delay during STP convergence.
✗
storm-control broadcast level 5.00
Why it's wrong here
Storm control limits traffic rates; it does not err-disable on switch attachment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓spanning-tree bpduguard enableCorrect answer▾
Why this is correct
BPDU Guard shuts down an access port that unexpectedly receives BPDUs from another switch.
✗switchport port-security maximum 1Wrong answer — click to see why▾
Why this is wrong here
Port security with maximum 1 limits the number of MAC addresses learned on the port, but it does not specifically detect or react to BPDUs from a switch. A switch could still connect and forward traffic without exceeding the MAC limit, so the port would not err-disable.
Why candidates choose this
Students might think that limiting MAC addresses to one would prevent a switch from connecting, but switches can have a single MAC address on an uplink, so this feature does not reliably detect a switch.
✗storm-control broadcast level 5.00Wrong answer — click to see why▾
Why this is wrong here
Storm control limits the amount of broadcast, multicast, or unknown unicast traffic on a port, but it does not detect the presence of a switch or cause an err-disable state upon receiving BPDUs. It is used to prevent traffic storms, not to enforce access port security.
Why candidates choose this
A test-taker might confuse storm control with BPDU Guard because both involve thresholds or events that can cause port actions, but storm control does not react to BPDUs or err-disable the port for switch detection.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
A frequent exam trap is selecting 'switchport port-security maximum 1' as a solution to prevent unauthorized switches. While port security limits MAC addresses, it does not detect BPDUs or immediately disable the port if a switch is connected. This can allow a switch to connect and cause Layer 2 loops. Another trap is confusing storm control with BPDU Guard; storm control only limits broadcast traffic rates and does not err-disable ports on BPDU reception. Candidates must understand that only BPDU Guard combined with PortFast provides the immediate err-disable protection for access ports against switch connections.
Detailed technical explanation
How to think about this question
Spanning Tree Protocol (STP) is designed to prevent Layer 2 loops in a switched network by blocking redundant paths. Normally, when a switchport comes up, STP places it in a listening and learning state before forwarding traffic, which can delay endpoint connectivity. PortFast is a Cisco enhancement that immediately transitions the port to the forwarding state, assuming the port connects to an end device, not another switch. This reduces connection delays for devices like PCs.
BPDU Guard is a complementary feature that protects the network by err-disabling a PortFast-enabled port if it receives any BPDUs. Since BPDUs are only sent by switches or bridges, their presence on a PortFast port indicates an unauthorized or misconnected switch. Err-disabling the port prevents potential Layer 2 loops and topology instability. This combination is essential for security and stability on access ports connected to end devices.
A common exam trap is confusing Port Security with BPDU Guard. While Port Security limits the number of MAC addresses on a port, it does not detect BPDUs or prevent switch connections effectively. Storm control limits broadcast traffic but does not err-disable ports on BPDU reception. Understanding the distinct roles of PortFast and BPDU Guard helps avoid misconfigurations and ensures proper protection of access ports in Cisco networks.
KKey Concepts to Remember
Spanning-tree PortFast immediately transitions a switchport to the forwarding state, allowing end devices to connect without delay during STP convergence.
BPDU Guard disables a port that receives Bridge Protocol Data Units (BPDUs) unexpectedly, protecting the network from potential loops caused by unauthorized switches.
An access port configured with PortFast assumes it connects to an end device and not another switch, speeding up port activation.
BPDU Guard works by err-disabling the port if any BPDU frames are detected, which indicates a switch or bridge is connected instead of a normal endpoint.
Port security limiting MAC addresses does not detect switch connections because switches can forward multiple MAC addresses, so it cannot reliably prevent switch uplinks.
Storm control limits broadcast traffic rates but does not err-disable ports upon detecting switch connections or BPDUs.
Combining PortFast and BPDU Guard on access ports ensures fast connectivity for legitimate endpoints and immediate shutdown if a switch is connected, preventing STP topology issues.
Switches use BPDUs to exchange spanning-tree information; receiving BPDUs on an access port configured for end devices is a sign of misconfiguration or unauthorized device.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Spanning-tree PortFast immediately transitions a switchport to the forwarding state, allowing end devices to connect without delay during STP convergence.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review spanning-tree PortFast immediately transitions a switchport to the forwarding state, allowing end devices to connect without delay during STP convergence., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — This question tests Network Services and Security — Spanning-tree PortFast immediately transitions a switchport to the forwarding state, allowing end devices to connect without delay during STP convergence..
What is the correct answer to this question?
The correct answer is: spanning-tree bpduguard enable — For edge access ports, PortFast brings the port up quickly for end devices, and BPDU Guard protects against someone connecting a switch by err-disabling the interface when BPDUs arrive.
What should I do if I get this 200-301 question wrong?
Review spanning-tree PortFast immediately transitions a switchport to the forwarding state, allowing end devices to connect without delay during STP convergence., then practise related 200-301 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "immediately / without restart". Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.
What is the key concept behind this question?
Spanning-tree PortFast immediately transitions a switchport to the forwarding state, allowing end devices to connect without delay during STP convergence.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.