CCNA Switching and Network Access Practice Question
A technician is troubleshooting a network-wide broadcast storm that has caused severe performance issues. The technician notices that BPDU guard is globally enabled on the access layer switch, but no ports are in an err-disabled state. All access ports have PortFast enabled. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the interaction between BPDU guard and BPDU filter, where candidates assume BPDU guard alone protects against rogue switches, forgetting that BPDU filter globally enabled on PortFast ports silently disables BPDU guard's detection mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BPDU filter is globally enabled, causing the switch to suppress BPDUs on PortFast ports and preventing BPDU guard from triggering.
BPDU guard places a port in err-disabled state upon receiving a BPDU, but BPDU filter globally enabled on PortFast ports suppresses both sending and receiving BPDUs. Since BPDU filter prevents BPDUs from being received, BPDU guard never triggers, allowing a rogue switch to participate in spanning tree and potentially cause a broadcast storm.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spanning tree is disabled globally, allowing the rogue switch to create a loop.
Why it's wrong here
If spanning tree were disabled, BPDU guard would also not function, but this is a less likely cause because the scenario shows BPDU guard is enabled, which implies STP is running. Additionally, a technician would likely notice if STP was disabled.
- ✗
BPDU guard is misconfigured on the wrong ports, so it failed to block the rogue switch.
Why it's wrong here
While BPDU guard can be configured per interface, a global BPDU guard configuration automatically applies to every PortFast-enabled port. The technician confirmed BPDU guard is globally enabled, so it would be active on all access ports regardless of any per-port misconfiguration. Misconfiguration on the wrong ports would only matter if BPDU guard were absent globally; here, the global setting overrides any local oversight. Thus, this is not the cause of the rogue switch being allowed to create a loop.
- ✗
Root guard is incorrectly enabled on the access ports, causing the rogue switch to become the root bridge.
Why it's wrong here
Root guard prevents a port from becoming a root port by ignoring superior BPDUs. If enabled, it would not cause a broadcast storm; it would simply block the port if a better BPDU was received. It does not prevent loop detection by STP.
- ✓
BPDU filter is globally enabled, causing the switch to suppress BPDUs on PortFast ports and preventing BPDU guard from triggering.
Why this is correct
Global BPDU filter on a switch sets PortFast on all access ports and disables BPDU transmission and reception on those ports. The rogue switch’s BPDUs are never processed, so BPDU guard—which depends on receiving a BPDU—never err-disables the port, allowing a loop and broadcast storm.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓BPDU filter is globally enabled, causing the switch to suppress BPDUs on PortFast ports and preventing BPDU guard from triggering.Correct answer▾
Why this is correct
Global BPDU filter on a switch sets PortFast on all access ports and disables BPDU transmission and reception on those ports. The rogue switch’s BPDUs are never processed, so BPDU guard—which depends on receiving a BPDU—never err-disables the port, allowing a loop and broadcast storm.
✗Spanning tree is disabled globally, allowing the rogue switch to create a loop.Wrong answer — click to see why▾
Why this is wrong here
This answer assumes STP is off entirely, but the presence of BPDU guard configuration indicates spanning tree is operational.
✗BPDU guard is misconfigured on the wrong ports, so it failed to block the rogue switch.Wrong answer — click to see why▾
Why this is wrong here
Candidates often assume that BPDU guard simply failed, overlooking the interaction with BPDU filter, which can neutralize guard by suppressing BPDUs.
✗Root guard is incorrectly enabled on the access ports, causing the rogue switch to become the root bridge.Wrong answer — click to see why▾
Why this is wrong here
Root guard is a different feature and not related to the suppression of BPDUs that would allow a loop to form undetected.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
BPDU
A Bridge Protocol Data Unit is a layer 2 frame that switches use to exchange information about the Spanning Tree Protocol (STP) to prevent network loops.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.