CCNA Switching and Network Access Practice Question
Exhibit
interface GigabitEthernet1/0/12 switchport mode access spanning-tree portfast spanning-tree bpduguard enable
A user connects a small unmanaged switch to an access port, and the port immediately transitions to err-disabled. Which feature most likely caused this behavior?
⚠ Common exam trap
Remember that BPDU Guard specifically targets BPDUs on PortFast ports, not general security or loop prevention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BPDU Guard
BPDU Guard is the correct answer because it is specifically designed to protect access ports configured with PortFast. When an unauthorized switch is connected to such a port, BPDU Guard detects the incoming BPDU and immediately places the port into err-disabled state, preventing potential loops or topology changes. UDLD aggressive detects unidirectional links but does not cause err-disabled due to BPDU reception. Root guard blocks ports that attempt to become the root bridge by placing them in root-inconsistent state (not err-disabled). Loop guard prevents alternate/root ports from becoming designated in the absence of BPDUs, putting the port into loop-inconsistent state, again not err-disabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
UDLD aggressive
Why it's wrong here
UDLD aggressive mode uses periodic probes to detect unidirectional links where traffic flows in only one direction. If a port stops receiving UDLD echoes, it err-disables the port, but this is unrelated to spanning-tree BPDUs. The problem described is a BPDU arriving on an access port, not a hardware-level one-way link failure, so UDLD aggressive would not address it.
When this WOULD be correct
If the question were about a scenario where a unidirectional link was created due to a faulty cable or misconfiguration, and the port transitioned to err-disabled due to UDLD aggressive detecting this condition, then option A would be the correct answer.
- ✓
BPDU Guard
Why this is correct
BPDU Guard is a spanning-tree protection feature applied to PortFast-enabled edge ports. When any BPDU is received on such a port, the switch immediately shuts the interface down and places it in an err-disabled state, because a legitimate access port should never receive BPDUs. This prevents an unauthorized user switch from participating in spanning tree and creating a Layer 2 loop.
- ✗
Root guard
Why it's wrong here
Root guard is used to enforce the root bridge placement by preventing a port from becoming a root port. If a superior BPDU arrives, root guard places the port into a root-inconsistent state and blocks it temporarily, but it does not err-disable the interface. In this case, the port is an access port with PortFast, and root guard would not react to the unauthorized switch because it only cares about BPDU priority, not the fact that a BPDU exists on an edge port.
When this WOULD be correct
In a scenario where a switch is configured to prevent a specific port from becoming the root port due to a topology change, a question might ask about the impact of connecting a device that sends BPDUs. In this case, root guard would be the correct answer if the port was configured to block root port transitions.
- ✗
Loop guard
Why it's wrong here
Loop guard is designed to detect the absence of BPDUs on a non-designated port, not their presence. If a root or alternate port stops receiving BPDUs due to a unidirectional link failure, loop guard blocks the port to prevent it from becoming designated and forwarding, which would create a loop. In this scenario, the port receives a BPDU, so loop guard would not take any action.
When this WOULD be correct
If the question were about a scenario where a switch port is experiencing a loop due to misconfigured trunking or multiple connections creating a loop, then loop guard would be the correct answer. In that case, the question would focus on preventing loops rather than the behavior of access ports.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓BPDU GuardCorrect answer▾
Why this is correct
BPDU Guard is a spanning-tree protection feature applied to PortFast-enabled edge ports. When any BPDU is received on such a port, the switch immediately shuts the interface down and places it in an err-disabled state, because a legitimate access port should never receive BPDUs. This prevents an unauthorized user switch from participating in spanning tree and creating a Layer 2 loop.
✗UDLD aggressiveWrong answer — click to see why▾
Why this is wrong here
UDLD aggressive mode is designed to detect and disable unidirectional links, not to respond to BPDU reception. It does not cause an err-disable state upon receiving BPDUs on an access port.
★ When this WOULD be the correct answer
If the question were about a scenario where a unidirectional link was created due to a faulty cable or misconfiguration, and the port transitioned to err-disabled due to UDLD aggressive detecting this condition, then option A would be the correct answer.
Why candidates choose this
Students may confuse UDLD with BPDU Guard because both are spanning-tree protection features that can place a port in err-disable state, but they operate on different triggers.
✗Root guardWrong answer — click to see why▾
Why this is wrong here
Root guard does not err-disable a port upon receiving any BPDU; instead, it places the port in a root-inconsistent state if a superior BPDU is received, preventing the port from becoming a root port. It does not cause an immediate err-disable transition.
★ When this WOULD be the correct answer
In a scenario where a switch is configured to prevent a specific port from becoming the root port due to a topology change, a question might ask about the impact of connecting a device that sends BPDUs. In this case, root guard would be the correct answer if the port was configured to block root port transitions.
Why candidates choose this
Root guard and BPDU Guard both involve BPDU processing and can cause port state changes, leading students to mistakenly think root guard would also err-disable the port.
✗Loop guardWrong answer — click to see why▾
Why this is wrong here
Loop guard is used to prevent alternate or root ports from becoming designated in the absence of BPDUs, not to respond to BPDU reception. It does not err-disable a port when a BPDU is received.
★ When this WOULD be the correct answer
If the question were about a scenario where a switch port is experiencing a loop due to misconfigured trunking or multiple connections creating a loop, then loop guard would be the correct answer. In that case, the question would focus on preventing loops rather than the behavior of access ports.
Why candidates choose this
The name 'loop guard' suggests it prevents loops, and students might assume it would react to an unauthorized switch by disabling the port, but its actual mechanism is different.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Bridge Protocol Data Unit
A Bridge Protocol Data Unit (BPDU) is a special message that network switches exchange to detect and prevent loops in an Ethernet network.
Key term
Loop Guard
Loop Guard is a Spanning Tree Protocol (STP) enhancement that prevents network loops by placing a blocked port into a loop-inconsistent state if it stops receiving Bridge Protocol Data Units (BPDUs), rather than transitioning it to a forwarding state.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.