Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA BPDU Guard Practice Question
Drag and drop the following steps into the correct order to configure and recover from a BPDU Guard violation on a PortFast-enabled access port using Cisco IOS-XE CLI commands.
⚠ Common exam trap
Confusing the global default command 'spanning-tree portfast bpduguard default' with the interface command 'spanning-tree bpduguard enable'. Also, remember that the 'errdisable recovery cause bpduguard' command is a global configuration command, not a privileged EXEC command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree bpduguard enable. 5. Exit to privileged EXEC mode. 6. Verify errdisable state. 7. Enter interface configuration mode. 8. Issue shutdown command. 9. Issue no shutdown command.
Only Option A correctly lists the steps to configure and manually recover from a BPDU Guard violation on a PortFast-enabled port. Option B is invalid because the command 'clear spanning-tree bpduguard' does not exist; the proper recovery is shutdown/no shutdown. Option C incorrectly applies the global command 'spanning-tree portfast bpduguard default' in interface mode; it should be used in global configuration mode. Option D includes an unnecessary 'Enter interface configuration mode' step after the global recovery command and does not reflect the correct sequence for automatic recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree bpduguard enable. 5. Exit to privileged EXEC mode. 6. Verify errdisable state. 7. Enter interface configuration mode. 8. Issue shutdown command. 9. Issue no shutdown command.
Why this is correct
This sequence is correct because it first uses the global command 'spanning-tree portfast default' to set PortFast on all access ports, then enters the target interface to enable BPDUguard with 'spanning-tree bpduguard enable'. Once a BPDU arrives, the port moves to errdisable state, which you confirm before manually recovering. Recovery is performed by entering interface configuration mode and cycling the interface with 'shutdown' followed by 'no shutdown'; this clears the error-disabled condition and returns the port to service. The order is valid because PortFast is configured globally, BPDUguard is enabled per interface, and the manual recovery command sequence is exactly what Cisco expects.
- ✗
1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree bpduguard enable. 5. Exit to privileged EXEC mode. 6. Issue clear spanning-tree bpduguard command. 7. Verify port is up.
Why it's wrong here
This option is invalid because 'clear spanning-tree bpduguard' does not exist in the Cisco IOS command set. There is no command to clear an errdisabled BPDUguard port by resetting the spanning-tree state; the errdisable condition can only be cleared by manually toggling the interface with 'shutdown' and 'no shutdown' or by using 'errdisable recovery' with a configured timer and cause. While the initial PortFast and BPDUguard configuration steps are correct, the recovery step is a fabricated command and would be rejected by the CLI.
- ✗
1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree portfast bpduguard default. 5. Exit to privileged EXEC mode. 6. Verify errdisable state. 7. Enter interface configuration mode. 8. Issue shutdown command. 9. Issue no shutdown command.
Why it's wrong here
This option fails because 'spanning-tree portfast bpduguard default' is a global configuration command that applies BPDUguard to all interfaces where PortFast is enabled, not an interface-level command. In interface configuration mode, the correct syntax to enable BPDUguard on that specific port is 'spanning-tree bpduguard enable'; entering the global default form in interface mode would either be rejected or would not produce the intended per-port configuration. The rest of the recovery steps are valid, but the wrong BPDUguard command in step 4 makes the configuration sequence incorrect.
- ✗
1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree bpduguard enable. 5. Exit to privileged EXEC mode. 6. Issue errdisable recovery cause bpduguard command. 7. Wait for timer. 8. Verify port is up.
Why it's wrong here
This option incorrectly treats 'errdisable recovery cause bpduguard' as a step to run after the port has already gone errdisabled, and places it in privileged EXEC mode. That command is actually a global configuration command that enables automatic recovery after the default 300-second errdisable timer, so it should be set before the failure if automatic recovery is desired; it does not provide the immediate recovery that manual shutdown/no shutdown does. In this sequence, even if the command were entered correctly from global config mode, the engineer would wait for the timer rather than actively recovering the port, and the verification step would be delayed by up to five minutes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree bpduguard enable. 5. Exit to privileged EXEC mode. 6. Verify errdisable state. 7. Enter interface configuration mode. 8. Issue shutdown command. 9. Issue no shutdown command.Correct answer▾
Why this is correct
This sequence is correct because it first uses the global command 'spanning-tree portfast default' to set PortFast on all access ports, then enters the target interface to enable BPDUguard with 'spanning-tree bpduguard enable'. Once a BPDU arrives, the port moves to errdisable state, which you confirm before manually recovering. Recovery is performed by entering interface configuration mode and cycling the interface with 'shutdown' followed by 'no shutdown'; this clears the error-disabled condition and returns the port to service. The order is valid because PortFast is configured globally, BPDUguard is enabled per interface, and the manual recovery command sequence is exactly what Cisco expects.
✗1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree bpduguard enable. 5. Exit to privileged EXEC mode. 6. Issue clear spanning-tree bpduguard command. 7. Verify port is up.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: The 'clear spanning-tree bpduguard' command does not bring a port out of errdisable; it only resets the BPDU guard violation count.
Why candidates choose this
Candidates might think that clearing the BPDU guard error is sufficient to recover the port, similar to clearing other error conditions.
✗1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree portfast bpduguard default. 5. Exit to privileged EXEC mode. 6. Verify errdisable state. 7. Enter interface configuration mode. 8. Issue shutdown command. 9. Issue no shutdown command.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: The command 'spanning-tree portfast bpduguard default' is a global command, not an interface command. Using it in interface mode is invalid.
Why candidates choose this
Candidates may confuse global and interface configuration modes for BPDU Guard, thinking 'default' can be used per interface.
✗1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree bpduguard enable. 5. Exit to privileged EXEC mode. 6. Issue errdisable recovery cause bpduguard command. 7. Wait for timer. 8. Verify port is up.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: The question specifies 'recover from a BPDU Guard violation' manually, not via automatic recovery. Using errdisable recovery is an alternative but not the manual steps requested.
Why candidates choose this
Candidates may know about errdisable recovery and think it is the correct manual recovery method, but it is automatic and not part of the manual CLI steps.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Root Guard, Loop Guard, and BPDU Guard in Rapid PVST+
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
PortFast
PortFast is a Cisco switch feature that immediately brings a port into the forwarding state, bypassing the normal Spanning Tree Protocol (STP) listening and learning phases, so that devices connected to that port can start communicating right away.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.