CCNA Switching and Network Access Practice Question
Exhibit
interface GigabitEthernet1/0/9 switchport mode access spanning-tree portfast spanning-tree bpduguard enable Event: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on PortFast enabled port. Disabling interface.
A network administrator notices that a switchport in access mode with PortFast enabled has transitioned to an err-disabled state. What is the most likely cause?
⚠ Common exam trap
Be careful not to confuse BPDU Guard with other port security features or network issues like duplex mismatches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BPDU Guard disabled the PortFast-enabled access port after it received a BPDU.
The strongest reason is a BPDU Guard violation on a PortFast-enabled access port. In practical terms, the port was expected to face an end host, not a switching device that emits BPDUs. When BPDUs appeared, the switch treated that as a topology-policy violation and error-disabled the interface to protect the network. This is one of the most classic access-layer protection patterns on the CCNA exam.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
BPDU Guard disabled the PortFast-enabled access port after it received a BPDU.
Why this is correct
BPDU Guard is a spanning-tree feature designed to protect PortFast-enabled access ports: when an unauthorized device sends a BPDU, the switch immediately errdisables the port to prevent a potential Layer 2 loop. The message 'psecure-violation' in the exhibit would actually correspond to port security, but the explicit reference to 'BPDU Guard' plus 'PortFast' confirms this exact behavior.
- ✗
Port security shut down the port because the VLAN was wrong.
Why it's wrong here
Port security enforcement shuts down a port when a MAC address violates the configured maximum or sticky settings, and it does not evaluate VLAN membership or BPDUs. The exhibit's message refers to BPDU Guard and PortFast, not to port security's 'psecure-violation' condition, so blaming a wrong VLAN is factually unsupported.
When this WOULD be correct
In a different question setup, if the scenario described a switchport configured with port security that was set to restrict access to a specific VLAN, and a device attempted to connect using an incorrect VLAN, then this option would be correct as it would lead to the port being shut down due to a security violation.
- ✗
DHCP snooping disabled the interface because a host requested an address.
Why it's wrong here
DHCP snooping operates at Layer 2 by validating DHCP server and client messages, and it can place a port in an errdisabled state only for DHCP-related violations. It does not process bridge protocol data units, and a host merely requesting an address is legitimate DHCP traffic, not a spanning-tree security event, so this cannot be why the switchport was disabled.
When this WOULD be correct
In a different question setup, if the scenario described a switchport that was configured with DHCP snooping and a rogue DHCP server was detected, causing the switch to disable the interface, then this option would be correct.
- ✗
EtherChannel suspended the interface because the bundle was incomplete.
Why it's wrong here
EtherChannel suspension occurs when the bundle has incompatible peer parameters or a member link fails, but the syslog event here names 'BPDU Guard' as the trigger. A partial bundle would not generate a spanning-tree violation message, so this option misattributes the cause to the wrong feature.
When this WOULD be correct
If the question asked about a situation where an EtherChannel was configured but one of the member links was down or misconfigured, leading to an incomplete bundle, then this option would be correct. In that case, the interface would go into a suspended state due to the EtherChannel configuration issue.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓BPDU Guard disabled the PortFast-enabled access port after it received a BPDU.Correct answer▾
Why this is correct
BPDU Guard is a spanning-tree feature designed to protect PortFast-enabled access ports: when an unauthorized device sends a BPDU, the switch immediately errdisables the port to prevent a potential Layer 2 loop. The message 'psecure-violation' in the exhibit would actually correspond to port security, but the explicit reference to 'BPDU Guard' plus 'PortFast' confirms this exact behavior.
✗Port security shut down the port because the VLAN was wrong.Wrong answer — click to see why▾
Why this is wrong here
Port security restricts access based on MAC addresses, not VLANs, and the event message explicitly mentions BPDU Guard, not port security. The exhibit shows a spanning-tree BPDU Guard error, not a port security violation.
★ When this WOULD be the correct answer
In a different question setup, if the scenario described a switchport configured with port security that was set to restrict access to a specific VLAN, and a device attempted to connect using an incorrect VLAN, then this option would be correct as it would lead to the port being shut down due to a security violation.
Why candidates choose this
Students may confuse port security with BPDU Guard because both can place a port in err-disabled state, but they serve different purposes: port security controls MAC addresses, while BPDU Guard prevents rogue switch connections.
✗DHCP snooping disabled the interface because a host requested an address.Wrong answer — click to see why▾
Why this is wrong here
DHCP snooping does not cause err-disabled state due to BPDU reception; it filters DHCP messages and can disable ports for DHCP attacks, but the exhibit clearly shows a spanning-tree BPDU Guard event.
★ When this WOULD be the correct answer
In a different question setup, if the scenario described a switchport that was configured with DHCP snooping and a rogue DHCP server was detected, causing the switch to disable the interface, then this option would be correct.
Why candidates choose this
DHCP snooping is another security feature that can err-disable ports, leading students to mistakenly attribute the BPDU Guard error to DHCP snooping if they overlook the specific syslog message.
✗EtherChannel suspended the interface because the bundle was incomplete.Wrong answer — click to see why▾
Why this is wrong here
EtherChannel suspension occurs due to configuration mismatches or link failures, not BPDU reception. The exhibit's syslog message explicitly identifies BPDU Guard, not EtherChannel issues.
★ When this WOULD be the correct answer
If the question asked about a situation where an EtherChannel was configured but one of the member links was down or misconfigured, leading to an incomplete bundle, then this option would be correct. In that case, the interface would go into a suspended state due to the EtherChannel configuration issue.
Why candidates choose this
EtherChannel can also cause err-disabled state, but the error message in the exhibit is clearly about spanning-tree BPDU Guard, not EtherChannel protocol mismatches.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Bridge Protocol Data Unit
A Bridge Protocol Data Unit (BPDU) is a special message that network switches exchange to detect and prevent loops in an Ethernet network.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.