Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Switching and Network Access Practice Question
Drag and drop the following steps into the correct order to configure Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports, and then recover a port that enters err-disabled state.
⚠ Common exam trap
The exam trap is confusing which protection goes on which port role. Remember: Root Guard protects designated ports from becoming root; Loop Guard protects non-designated ports from becoming forwarding; BPDU Guard protects PortFast ports. Also, recovery order: global first, then interface re-enable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Enable errdisable recovery globally. 5. Re-enable the err-disabled port manually.
Only option A correctly follows the sequence of configuring Root Guard on designated ports, Loop Guard on non-designated ports, BPDU Guard on PortFast ports, then enabling errdisable recovery globally, and finally manually re-enabling the port. Option B assigns Loop Guard to designated ports and Root Guard to non-designated ports, which is incorrect. Option C correctly assigns protections but starts with BPDU Guard, deviating from the specified order. Option D assigns Root Guard to non-designated ports and Loop Guard to designated ports, which is incorrect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Enable errdisable recovery globally. 5. Re-enable the err-disabled port manually.
Why this is correct
This sequence is correct. It configures Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports in the order stated, then enables global errdisable recovery and manually re-enables the port.
- ✗
1. Configure Loop Guard on designated ports. 2. Configure Root Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Re-enable the err-disabled port manually. 5. Enable errdisable recovery globally.
Why it's wrong here
This sequence is incorrect because Loop Guard is applied to the wrong port role: it is intended for non-designated (root or alternate) ports to prevent them from forwarding when BPDUs cease, while designated ports are already actively sending BPDUs. Root Guard is likewise misplaced; it should protect designated ports by putting them in root-inconsistent state if a superior BPDU arrives, not be applied to non-designated ports. Additionally, the recovery order is reversed: errdisable recovery must be enabled globally before any manual re-enable, otherwise the port may simply fall back to error-disabled and not recover automatically.
- ✗
1. Configure BPDU Guard on PortFast ports. 2. Configure Root Guard on designated ports. 3. Configure Loop Guard on non-designated ports. 4. Re-enable the err-disabled port manually. 5. Enable errdisable recovery globally.
Why it's wrong here
Although this sequence correctly places Root Guard on designated ports and Loop Guard on non-designated ports, it violates the prescribed order by configuring BPDU Guard first, and it places manual re-enable before enabling errdisable recovery. In the correct procedure, BPDU Guard is applied only after the STP protection mechanisms are in place, because PortFast ports are typically edge ports and their BPDU filtering should be the final hardening step. Also, enabling errdisable recovery globally is a prerequisite for a robust automatic recovery; manually re-enabling a port before that setting is configured leaves the switch dependent on human intervention and defeats the purpose of the global timer.
- ✗
1. Configure Root Guard on non-designated ports. 2. Configure Loop Guard on designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Enable errdisable recovery globally. 5. Re-enable the err-disabled port manually.
Why it's wrong here
The recovery portion (global errdisable recovery before manual re-enable) follows the correct order, but the STP protection configuration is completely reversed. Root Guard is meant for designated ports to shield the root bridge from being overtaken by a higher-priority switch; putting it on non-designated ports provides no useful protection since those ports already receive BPDUs and should not become root. Loop Guard belongs on non-designated ports to protect against unidirectional links that allow alternate ports to erroneously forward, not on designated ports which normally forward by design. Therefore, despite the correct recovery steps, the entire sequence is invalid.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Enable errdisable recovery globally. 5. Re-enable the err-disabled port manually.Correct answer▾
Why this is correct
This sequence is correct. It configures Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports in the order stated, then enables global errdisable recovery and manually re-enables the port.
✗1. Configure Loop Guard on designated ports. 2. Configure Root Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Re-enable the err-disabled port manually. 5. Enable errdisable recovery globally.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: Loop Guard is for non-designated ports (alternate/backup), Root Guard is for designated ports. Recovery order: global enable first, then manual re-enable.
Why candidates choose this
Candidates may confuse the port roles for Root Guard and Loop Guard, or think that manual re-enablement should precede global recovery configuration.
✗1. Configure BPDU Guard on PortFast ports. 2. Configure Root Guard on designated ports. 3. Configure Loop Guard on non-designated ports. 4. Re-enable the err-disabled port manually. 5. Enable errdisable recovery globally.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: The order of configuring protections is not strictly sequential, but BPDU Guard is often applied last. Recovery order is wrong: global enable before manual re-enable.
Why candidates choose this
Candidates might think BPDU Guard should be configured first because it's commonly used, or they may not realize the correct recovery sequence.
✗1. Configure Root Guard on non-designated ports. 2. Configure Loop Guard on designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Enable errdisable recovery globally. 5. Re-enable the err-disabled port manually.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: Root Guard is for designated ports, Loop Guard is for non-designated ports. The options swap these roles.
Why candidates choose this
Candidates often confuse the port roles for Root Guard and Loop Guard, thinking Root Guard protects against loops (which is Loop Guard's function).
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
PortFast
PortFast is a Cisco switch feature that immediately brings a port into the forwarding state, bypassing the normal Spanning Tree Protocol (STP) listening and learning phases, so that devices connected to that port can start communicating right away.
Key term
Root Guard
Root Guard is a Spanning Tree Protocol (STP) feature that protects the root bridge placement on a network port to prevent unauthorized switches from becoming the root bridge.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.