CCNA Network Services and Security Practice Question
An engineer wants users to get fast link-up on access ports but also wants the switch to disable a port if another switch is connected and sends BPDUs.
Which combination of features best meets that requirement?
⚠ Common exam trap
Avoid confusing BPDU Guard with other guard features like Root Guard or Loop Guard, which serve different purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PortFast and BPDU Guard
PortFast and BPDU Guard are the classic edge-port combination for this requirement. PortFast helps a user-facing interface begin forwarding quickly so a PC or phone does not wait through the normal spanning-tree transition delay. BPDU Guard adds protection by monitoring that same port for BPDUs. If a switch is accidentally or intentionally connected and starts participating in spanning tree, BPDU Guard reacts by disabling the port to protect the Layer 2 topology. In plain language, users get quick connectivity when the port is used correctly, but the network still protects itself against someone plugging in a switch where only an endpoint should exist. That is exactly what the requirement asks for.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
PortFast and BPDU Guard
Why this is correct
PortFast bypasses the spanning-tree listening and learning states, allowing a host-facing access port to transition directly to forwarding and deliver immediate link-up. BPDU Guard complements this by shutting the port in an error-disabled state if any BPDU is received, which blocks an accidental or rogue switch connection while preserving the fast-start behavior for legitimate hosts. Together they form the standard Cisco edge-port hardening pair.
- ✗
DHCP snooping and DAI
Why it's wrong here
DHCP snooping and Dynamic ARP Inspection are useful security features, but they solve different problems. They help protect address assignment and ARP behavior, not the specific combination of fast access-port startup and protection against a rogue or accidental switch connection.
When this WOULD be correct
If the exam question asked for features to enhance network security and prevent unauthorized DHCP servers while ensuring valid DHCP traffic, then DHCP snooping and DAI would be the correct answer, as they work together to secure the DHCP infrastructure.
- ✗
Root Guard and VTP pruning
Why it's wrong here
Root Guard can help in spanning-tree design, but it is not the standard feature used to give quick edge-port startup. VTP pruning is unrelated to the core requirement. The question is specifically describing the common edge-port hardening pair, which is PortFast with BPDU Guard.
When this WOULD be correct
If the exam question focused on maintaining the stability of the spanning tree topology in a multi-switch environment while allowing for efficient VLAN management, then Root Guard could be the correct answer. For instance, a scenario where the goal is to prevent a switch from becoming the root bridge would make this option valid.
- ✗
Port security and CDP
Why it's wrong here
Port security restricts the source MAC addresses allowed on an access port, while CDP advertises and discovers directly connected Cisco neighbor devices; neither addresses the speed of link initialization. Port security does not change spanning-tree convergence, and CDP merely reports device information rather than preventing a switch from being attached. As a result, this combination solves a different set of access-layer concerns and fails to deliver both the fast link-up and BPDU-based protection described in the question.
When this WOULD be correct
If the exam question asked for a method to secure access ports against unauthorized devices while also enabling monitoring of connected devices, then Port security and CDP could be the correct answer. This would focus on ensuring only known devices connect while utilizing CDP for network topology information.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓PortFast and BPDU GuardCorrect answer▾
Why this is correct
PortFast bypasses the spanning-tree listening and learning states, allowing a host-facing access port to transition directly to forwarding and deliver immediate link-up. BPDU Guard complements this by shutting the port in an error-disabled state if any BPDU is received, which blocks an accidental or rogue switch connection while preserving the fast-start behavior for legitimate hosts. Together they form the standard Cisco edge-port hardening pair.
✗DHCP snooping and DAIWrong answer — click to see why▾
Why this is wrong here
DHCP snooping and DAI (Dynamic ARP Inspection) do not address the requirement of disabling a port upon receiving BPDUs; they focus on protecting against rogue DHCP servers and ARP spoofing, respectively.
★ When this WOULD be the correct answer
If the exam question asked for features to enhance network security and prevent unauthorized DHCP servers while ensuring valid DHCP traffic, then DHCP snooping and DAI would be the correct answer, as they work together to secure the DHCP infrastructure.
Why candidates choose this
Candidates may find this option tempting because both DHCP snooping and DAI are well-known security features in networking, leading them to mistakenly associate them with port protection and network integrity.
✗Root Guard and VTP pruningWrong answer — click to see why▾
Why this is wrong here
Root Guard and VTP pruning do not address the requirement of quickly enabling access ports and disabling them upon receiving BPDUs. Root Guard is used to prevent a port from becoming a root port, while VTP pruning optimizes VLAN traffic, neither of which directly manage port states based on BPDU reception.
★ When this WOULD be the correct answer
If the exam question focused on maintaining the stability of the spanning tree topology in a multi-switch environment while allowing for efficient VLAN management, then Root Guard could be the correct answer. For instance, a scenario where the goal is to prevent a switch from becoming the root bridge would make this option valid.
Why candidates choose this
Candidates may choose this option because they recognize the importance of spanning tree protocols and may mistakenly believe that Root Guard's function of managing root bridge elections aligns with the need to control port states in response to BPDUs.
✗Port security and CDPWrong answer — click to see why▾
Why this is wrong here
Port security and CDP do not provide the necessary functionality to disable a port when BPDUs are received. Port security can limit the number of MAC addresses but does not specifically address BPDU handling.
★ When this WOULD be the correct answer
If the exam question asked for a method to secure access ports against unauthorized devices while also enabling monitoring of connected devices, then Port security and CDP could be the correct answer. This would focus on ensuring only known devices connect while utilizing CDP for network topology information.
Why candidates choose this
Candidates may choose this option because they recognize that Port security is a common feature for securing switch ports, and they might mistakenly believe that CDP's monitoring capabilities align with the requirements of the question.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
BPDU Guard
BPDU Guard is a Cisco switch feature that protects the network from unauthorized devices by disabling a port if it receives a Bridge Protocol Data Unit (BPDU).
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.