Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
6Step 6
7Step 7
CCNA Switching and Network Access Practice Question
Drag and drop the following steps into the correct order to configure BPDU Guard, Loop Guard, and Root Guard on a Cisco switch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enter global configuration mode using the configure terminal command.
The correct order starts by entering global configuration mode, then globally enabling PortFast on all access ports to allow immediate transition to forwarding state. BPDU Guard is then enabled globally on all PortFast-enabled ports to protect against unauthorized switches. Next, Loop Guard is enabled globally to prevent loops from unidirectional links. Afterwards, the specific uplink interface is selected and Root Guard is applied to prevent a rogue switch from becoming the root bridge. This sequence follows Cisco best practices: apply fast convergence first, then protect the edge with BPDU Guard, apply loop prevention globally, and finally secure core links with Root Guard.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enter global configuration mode using the configure terminal command.
Why this is correct
Enter global configuration mode using the configure terminal command. This is the first step to make any configuration changes on a Cisco switch. It changes from privileged EXEC mode to global configuration mode, allowing access to subconfiguration modes for interfaces, VLANs, spanning-tree settings, etc. Without this, the subsequent commands to modify PortFast, BPDU Guard, Loop Guard, or Root Guard would not be accepted.
- ✓
Enable PortFast on all access ports with the command spanning-tree portfast default.
Why this is correct
Enable PortFast on all access ports with the command spanning-tree portfast default. This command globally sets PortFast on all access ports, meaning interfaces configured as switchport mode access will transition directly to forwarding state, bypassing listening and learning. This prevents delays caused by spanning-tree convergence for hosts that should not generate BPDUs. It applies to all access ports but not to trunk ports.
- ✓
Enable BPDU Guard on all PortFast-enabled ports using spanning-tree portfast bpduguard default.
Why this is correct
Enable BPDU Guard on all PortFast-enabled ports using spanning-tree portfast bpduguard default. This command enables BPDU Guard on all interfaces that have PortFast enabled. If a BPDU is received on such an interface, the switch will errdisable the port to prevent loops from an unauthorized switch. It must be applied after PortFast default because it targets those ports.
- ✓
Enable Loop Guard globally on all VLANs with the command spanning-tree loopguard default.
Why this is correct
Enable Loop Guard globally on all VLANs with the command spanning-tree loopguard default. Loop Guard complements BPDU Guard by preventing a port from incorrectly transitioning to forwarding if BPDUs stop being received. It places the port into an inconsistent state if it stops receiving BPDUs, thus preventing unidirectional link failures from causing loops. This command is global and applies to all VLANs on the switch.
- ✓
Enter interface configuration mode for the designated trunk port (e.g., interface GigabitEthernet0/1).
Why this is correct
Enter interface configuration mode for the designated trunk port (e.g., interface GigabitEthernet0/1). Trunk ports require Root Guard to protect against a rogue switch being elected as root bridge. The interface configuration mode allows for per-interface spanning-tree settings. The trunk port is the connection to other switches, and Root Guard should be enabled on that port.
- ✓
Enable Root Guard on that interface using spanning-tree guard root.
Why this is correct
Enable Root Guard on that interface using spanning-tree guard root. Root Guard ensures that the designated port is not allowed to become a root port. If the port receives a superior BPDU, it is placed in a root-inconsistent state, which is effectively blocked, so that a rogue switch cannot become the root. This protects the spanning-tree topology from unauthorized changes.
- ✓
End the configuration session and save the running configuration with copy running-config startup-config.
Why this is correct
End the configuration session and save the running configuration with copy running-config startup-config. After configuring spanning-tree protections, it is crucial to save the configuration so that it persists across a reload. Without this, all changes would be lost on reboot. This also verifies that the configuration is complete and ready for production.
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
Loop Guard
Loop Guard is a Spanning Tree Protocol (STP) enhancement that prevents network loops by placing a blocked port into a loop-inconsistent state if it stops receiving Bridge Protocol Data Units (BPDUs), rather than transitioning it to a forwarding state.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.