CCNA Switching and Network Access Practice Question
A network administrator implements a set of spanning-tree enhancements to secure the switching infrastructure. Later, a help desk ticket reports that a user in a remote office cannot connect to any network resources. While investigating, the administrator notices that the switch port connecting the remote office switch to the distribution switch is in a 'root-inconsistent' state and is blocking traffic. Which protection feature, if misapplied, most likely caused this issue?
⚠ Common exam trap
Cisco often tests the distinction between 'root-inconsistent' (Root Guard) and 'loop-inconsistent' (Loop Guard) states, and the trap here is that candidates confuse the two or assume BPDU Guard is responsible for any BPDU-related blocking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Root Guard
Root Guard is the correct answer because it forces an interface to be a designated port. If a switch receives a superior BPDU (indicating a root bridge with a lower bridge ID) on a Root Guard-enabled port, the port is placed into a 'root-inconsistent' state and blocks traffic to prevent the attached switch from becoming the root bridge. This matches the symptom described: a port in 'root-inconsistent' state blocking traffic after spanning-tree enhancements were applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Loop Guard
Why it's wrong here
Loop Guard protects against unidirectional link failures by monitoring the absence of BPDUs. If a port stops receiving BPDUs from its root or alternate port, Loop Guard transitions it to a loop-inconsistent state, which blocks traffic like a listening state, and automatically recovers when BPDUs resume. It does not react to receiving a superior BPDU; in fact, the scenario describes a BPDU arriving, the exact opposite of the missing-BPDU condition Loop Guard detects. Therefore, Loop Guard would not place the port into root-inconsistent state.
- ✓
Root Guard
Why this is correct
Root Guard ensures that a port cannot become a root port. When a superior BPDU is received on a Root Guard-enabled port, the port transitions to a root-inconsistent state and blocks traffic, exactly as described in the scenario.
- ✗
BPDU Guard
Why it's wrong here
BPDU Guard is a port-security feature designed for access ports that should never receive BPDUs. When any BPDU is received, BPDU Guard immediately places the port in an err-disabled state, effectively shutting it down and requiring manual intervention or errdisable recovery. This is a binary reaction to any unexpected BPDU, not a selective response to a superior BPDU, and the resulting state is not a spanning-tree block state like root-inconsistent. Thus, BPDU Guard does not match the described behavior of transitioning to a root-inconsistent state.
- ✗
BPDU Filter
Why it's wrong here
BPDU Filter disables BPDU processing on a port entirely, both suppressing outbound BPDUs and discarding inbound BPDUs. Instead of providing protection, it intentionally allows STP to be blind on that port, which can create bridging loops because the switch will not detect a superior BPDU or a loop. This is the opposite of a protective state: the port remains operational and can forward traffic, never entering root-inconsistent or any blocking state. Therefore, BPDU Filter is incorrect for a scenario where a superior BPDU causes a port to block.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Root GuardCorrect answer▾
Why this is correct
Root Guard ensures that a port cannot become a root port. When a superior BPDU is received on a Root Guard-enabled port, the port transitions to a root-inconsistent state and blocks traffic, exactly as described in the scenario.
✗Loop GuardWrong answer — click to see why▾
Why this is wrong here
A loop-inconsistent state is different from the root-inconsistent state observed. Loop Guard acts when BPDUs stop arriving, not when they appear with a superior root claim.
✗BPDU GuardWrong answer — click to see why▾
Why this is wrong here
While BPDU Guard also reacts to incoming BPDUs, it puts the port in err-disabled (shutdown) state, not a blocking state named 'root-inconsistent'. The symptom described is not error-disabled.
✗BPDU FilterWrong answer — click to see why▾
Why this is wrong here
BPDU Filter would not cause the port to show a root-inconsistent state. The symptom is a protective blocking state, which BPDU Filter does not provide.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Root Guard
Root Guard is a Spanning Tree Protocol (STP) feature that protects the root bridge placement on a network port to prevent unauthorized switches from becoming the root bridge.
Key term
Bridge ID
The Bridge ID is an 8-byte value used in Spanning Tree Protocol to uniquely identify each bridge or switch in a network and determine the root bridge of the spanning tree topology.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.