Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Switching and Network Access Practice Question
Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port in RSTP.
⚠ Common exam trap
Do not confuse the order: configuration must precede the violation. Also, recovery requires removing the rogue switch before bouncing the interface; failing to do so will cause the port to trip again.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure PortFast and BPDU guard on the interface.
Configure PortFast and BPDU guard on the access port. Then trigger a violation by connecting an unauthorized switch, which causes the port to error-disable. Diagnose by checking the error-disabled status. To recover, first remove the offending device, then cycle the port with shutdown and no shutdown; otherwise the port will immediately go error-disabled again.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure PortFast and BPDU guard on the interface.
Why this is correct
Configuring PortFast and BPDU guard on the interface is the foundational protective measure. PortFast immediately moves the port to the forwarding state, bypassing STP listening and learning, while BPDU guard will shut down the port if any BPDU is received. This prevents a rogue switch from being able to participate in spanning-tree elections or cause topology loops, making it the essential first step in safeguarding an access port.
- ✓
Trigger a BPDU guard violation by connecting a switch to the port.
Why this is correct
Triggering a BPDU guard violation by physically connecting a switch to the protected port is a deliberate verification technique. The switch sends BPDUs, and BPDU guard reacts by error-disabling the port, confirming that the protection is actively working. This step validates the configuration and ensures that an unauthorized device will not be allowed to disrupt the network, serving as a controlled test of the security mechanism.
- ✓
Diagnose the violation by checking the error-disabled status.
Why this is correct
Diagnosing the violation by checking the error-disabled status is crucial for confirming the cause. Using 'show interfaces status err-disabled' or 'show errdisable detect' reveals that the port went down due to a BPDU guard violation, not a cable fault or other error. This step allows the administrator to distinguish between legitimate BPDUs and other reasons the port may have been disabled, ensuring accurate troubleshooting and preventing unnecessary reconfiguration.
- ✓
Remove the unauthorized switch, then recover the port by issuing the 'shutdown' and 'no shutdown' commands.
Why this is correct
Removing the unauthorized switch and then issuing 'shutdown' and 'no shutdown' commands recovers the port from the error-disabled state. The manual interface bounce clears the error-disabled condition immediately, without relying on errdisable recovery timers. This step must occur after the offending device is physically disconnected; otherwise, BPDU guard would once again disable the port, so the sequence is vital for restoring normal operation.
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Rapid Spanning Tree Protocol
Rapid Spanning Tree Protocol (RSTP) is a network protocol that prevents loops in Ethernet networks by quickly recalculating the best path when a link fails.
Key term
BPDU Guard
BPDU Guard is a Cisco switch feature that protects the network from unauthorized devices by disabling a port if it receives a Bridge Protocol Data Unit (BPDU).
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.