CCNA Switching and Network Access Practice Question
This 200-301 practice question tests your understanding of switching and network access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: bPDU Guard disables a PortFast-enabled access port immediately upon receiving a BPDU to prevent potential Layer 2 loops or topology changes.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A user connects a small unmanaged switch to an access port, and the port immediately transitions to err-disabled. Which feature most likely caused this behavior?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Clue: "immediately / without restart"
Why it matters: Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BPDU Guard
BPDU Guard is the correct answer because it is specifically designed to protect access ports configured with PortFast. When an unauthorized switch is connected to such a port, BPDU Guard detects the incoming BPDU and immediately places the port into err-disabled state, preventing potential loops or topology changes. UDLD aggressive detects unidirectional links but does not cause err-disabled due to BPDU reception. Root guard blocks ports that attempt to become the root bridge by placing them in root-inconsistent state (not err-disabled). Loop guard prevents alternate/root ports from becoming designated in the absence of BPDUs, putting the port into loop-inconsistent state, again not err-disabled.
Key principle: BPDU Guard disables a PortFast-enabled access port immediately upon receiving a BPDU to prevent potential Layer 2 loops or topology changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
UDLD aggressive
Why it's wrong here
This is wrong because UDLD aggressive is related to one-way link failures, not this spanning-tree protection response.
When this WOULD be correct
If the question were about a scenario where a unidirectional link was created due to a faulty cable or misconfiguration, and the port transitioned to err-disabled due to UDLD aggressive detecting this condition, then option A would be the correct answer.
✓
BPDU Guard
Why this is correct
This is correct because BPDU Guard disables a PortFast-enabled interface if a BPDU is received.
Clue confirmation
The clue words "most likely", "immediately / without restart" in the question point toward this answer.
Related concept
BPDU Guard disables a PortFast-enabled access port immediately upon receiving a BPDU to prevent potential Layer 2 loops or topology changes.
✗
Root guard
Why it's wrong here
This is wrong because root guard is intended to stop a port from becoming a root port when superior BPDUs are received.
When this WOULD be correct
In a scenario where a switch is configured to prevent a specific port from becoming the root port due to a topology change, a question might ask about the impact of connecting a device that sends BPDUs. In this case, root guard would be the correct answer if the port was configured to block root port transitions.
✗
Loop guard
Why it's wrong here
This is wrong because loop guard protects against certain non-designated port failures, not this classic edge-port err-disable event.
When this WOULD be correct
If the question were about a scenario where a switch port is experiencing a loop due to misconfigured trunking or multiple connections creating a loop, then loop guard would be the correct answer. In that case, the question would focus on preventing loops rather than the behavior of access ports.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓BPDU GuardCorrect answer▾
Why this is correct
This is correct because BPDU Guard disables a PortFast-enabled interface if a BPDU is received.
✗UDLD aggressiveWrong answer — click to see why▾
Why this is wrong here
UDLD aggressive mode is designed to detect and disable unidirectional links, not to respond to BPDU reception. It does not cause an err-disable state upon receiving BPDUs on an access port.
★ When this WOULD be the correct answer
If the question were about a scenario where a unidirectional link was created due to a faulty cable or misconfiguration, and the port transitioned to err-disabled due to UDLD aggressive detecting this condition, then option A would be the correct answer.
Why candidates choose this
Students may confuse UDLD with BPDU Guard because both are spanning-tree protection features that can place a port in err-disable state, but they operate on different triggers.
✗Root guardWrong answer — click to see why▾
Why this is wrong here
Root guard does not err-disable a port upon receiving any BPDU; instead, it places the port in a root-inconsistent state if a superior BPDU is received, preventing the port from becoming a root port. It does not cause an immediate err-disable transition.
★ When this WOULD be the correct answer
In a scenario where a switch is configured to prevent a specific port from becoming the root port due to a topology change, a question might ask about the impact of connecting a device that sends BPDUs. In this case, root guard would be the correct answer if the port was configured to block root port transitions.
Why candidates choose this
Root guard and BPDU Guard both involve BPDU processing and can cause port state changes, leading students to mistakenly think root guard would also err-disable the port.
✗Loop guardWrong answer — click to see why▾
Why this is wrong here
Loop guard is used to prevent alternate or root ports from becoming designated in the absence of BPDUs, not to respond to BPDU reception. It does not err-disable a port when a BPDU is received.
★ When this WOULD be the correct answer
If the question were about a scenario where a switch port is experiencing a loop due to misconfigured trunking or multiple connections creating a loop, then loop guard would be the correct answer. In that case, the question would focus on preventing loops rather than the behavior of access ports.
Why candidates choose this
The name 'loop guard' suggests it prevents loops, and students might assume it would react to an unauthorized switch by disabling the port, but its actual mechanism is different.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
Remember that BPDU Guard specifically targets BPDUs on PortFast ports, not general security or loop prevention.
Detailed technical explanation
How to think about this question
BPDU Guard is a Cisco Catalyst switch feature designed to protect the Spanning Tree Protocol (STP) topology by disabling ports that receive Bridge Protocol Data Units (BPDUs) unexpectedly. It is typically enabled on access ports configured with PortFast, which allows ports to bypass the usual STP listening and learning states and transition immediately to forwarding. This setup assumes that the port connects only to end devices, not other switches, so any BPDU received signals a potential topology issue or misconfiguration.
When BPDU Guard is enabled on a PortFast-enabled port, the switch monitors incoming frames for BPDUs. If a BPDU is detected, BPDU Guard immediately places the port into an err-disabled state, effectively shutting it down to prevent possible Layer 2 loops or topology instability. This behavior is crucial in environments where unauthorized switches or devices might be connected, as it prevents the spread of incorrect spanning tree information that could disrupt the network.
A common exam trap is confusing BPDU Guard with other STP protection features like Root Guard or Loop Guard. Unlike Root Guard, which blocks ports from becoming root ports but does not err-disable them, BPDU Guard actively disables the port on BPDU receipt. Similarly, Loop Guard protects against unidirectional link failures on non-designated ports but does not err-disable access ports receiving BPDUs. Understanding these distinctions helps avoid misinterpretation of port states and ensures correct configuration for network stability.
KKey Concepts to Remember
BPDU Guard disables a PortFast-enabled access port immediately upon receiving a BPDU to prevent potential Layer 2 loops or topology changes.
PortFast allows access ports to transition quickly to the forwarding state but assumes no switches are connected, making BPDU Guard essential for protection.
UDLD aggressive mode detects unidirectional link failures but does not err-disable ports due to BPDU reception on access ports.
Root Guard prevents a port from becoming a root port by blocking superior BPDUs but does not err-disable the port upon BPDU receipt.
Loop Guard protects against indirect link failures on non-designated ports and does not trigger err-disable on access ports receiving BPDUs.
An err-disabled state caused by BPDU Guard requires manual or automatic recovery to re-enable the port after a BPDU is detected.
Access ports connected to end devices should have PortFast and BPDU Guard enabled to maintain stable Layer 2 topology and prevent loops.
Receiving BPDUs on a PortFast-enabled access port indicates a misconfiguration or unauthorized switch connection, triggering BPDU Guard.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
BPDU Guard disables a PortFast-enabled access port immediately upon receiving a BPDU to prevent potential Layer 2 loops or topology changes.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review bPDU Guard disables a PortFast-enabled access port immediately upon receiving a BPDU to prevent potential Layer 2 loops or topology changes., then practise related 200-301 questions on the same topic to reinforce the concept.
Switching and Network Access — This question tests Switching and Network Access — BPDU Guard disables a PortFast-enabled access port immediately upon receiving a BPDU to prevent potential Layer 2 loops or topology changes..
What is the correct answer to this question?
The correct answer is: BPDU Guard — BPDU Guard is the correct answer because it is specifically designed to protect access ports configured with PortFast. When an unauthorized switch is connected to such a port, BPDU Guard detects the incoming BPDU and immediately places the port into err-disabled state, preventing potential loops or topology changes. UDLD aggressive detects unidirectional links but does not cause err-disabled due to BPDU reception. Root guard blocks ports that attempt to become the root bridge by placing them in root-inconsistent state (not err-disabled). Loop guard prevents alternate/root ports from becoming designated in the absence of BPDUs, putting the port into loop-inconsistent state, again not err-disabled.
What should I do if I get this 200-301 question wrong?
Review bPDU Guard disables a PortFast-enabled access port immediately upon receiving a BPDU to prevent potential Layer 2 loops or topology changes., then practise related 200-301 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "most likely", "immediately / without restart". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
BPDU Guard disables a PortFast-enabled access port immediately upon receiving a BPDU to prevent potential Layer 2 loops or topology changes.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.