Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Switching and Network Access Practice Question
Drag and drop the following steps into the correct order to configure Root Guard on a designated port, Loop Guard on a non-designated port, and BPDU Guard on a PortFast port, along with the recovery steps when a port enters err-disabled state.
⚠ Common exam trap
The trap is that candidates may think the order of configuring the guards is arbitrary, but the question explicitly requires a specific sequence. Pay close attention to the order in which features are listed in the stem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
1. Enter global configuration mode. 2. Configure Root Guard on the designated port. 3. Configure Loop Guard on the non-designated port. 4. Configure BPDU Guard on the PortFast-enabled port. 5. Configure errdisable recovery for BPDU Guard.
The order follows the logical sequence: enter config mode, then configure each guard feature on its respective port, and finally set the errdisable recovery to automatically re-enable ports after a BPDU Guard violation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
1. Enter global configuration mode. 2. Configure Root Guard on the designated port. 3. Configure Loop Guard on the non-designated port. 4. Configure BPDU Guard on the PortFast-enabled port. 5. Configure errdisable recovery for BPDU Guard.
Why this is correct
This sequence correctly follows the logical order: first enter configuration mode, then apply each guard feature to its appropriate port type, and finally set errdisable recovery to automatically re-enable ports after a BPDU Guard violation.
- ✗
1. Enter global configuration mode. 2. Configure BPDU Guard on the PortFast-enabled port. 3. Configure Root Guard on the designated port. 4. Configure Loop Guard on the non-designated port. 5. Configure errdisable recovery for BPDU Guard.
Why it's wrong here
This order is incorrect because it places BPDU Guard configuration before Root Guard and Loop Guard, but the order of configuring the guards themselves is not critical; however, the sequence must start with entering config mode and end with errdisable recovery. The main issue is that the order of guard configurations is arbitrary, but the question expects a specific sequence that matches the typical order of listing in the stem.
- ✗
1. Enter global configuration mode. 2. Configure Loop Guard on the non-designated port. 3. Configure Root Guard on the designated port. 4. Configure BPDU Guard on the PortFast-enabled port. 5. Configure errdisable recovery for BPDU Guard.
Why it's wrong here
The expected sequence begins by configuring Root Guard on the designated port before Loop Guard on the non-designated port, because the designated port is the one facing the root bridge and needs root protection first. Placing Loop Guard first reverses this order, so even though both commands are valid, the sequence fails to follow the required configuration order. In a strictly ordered configuration task, each switch protection must be applied in the sequence listed; looping from Loop Guard first is not the standard progression.
- ✗
1. Enter global configuration mode. 2. Configure Root Guard on the designated port. 3. Configure BPDU Guard on the PortFast-enabled port. 4. Configure Loop Guard on the non-designated port. 5. Configure errdisable recovery for BPDU Guard.
Why it's wrong here
This sequence correctly starts with Root Guard, but it configures BPDU Guard on the PortFast-enabled access port before applying Loop Guard on the non-designated port. BPDU Guard is an edge-port protection that should typically be configured alongside PortFast at the edge of the network, whereas Loop Guard protects shared or blocked ports from receiving stale BPDUs. Because the expected order places Loop Guard before BPDU Guard, this option is incorrect despite using all the correct commands.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓1. Enter global configuration mode. 2. Configure Root Guard on the designated port. 3. Configure Loop Guard on the non-designated port. 4. Configure BPDU Guard on the PortFast-enabled port. 5. Configure errdisable recovery for BPDU Guard.Correct answer▾
Why this is correct
This sequence correctly follows the logical order: first enter configuration mode, then apply each guard feature to its appropriate port type, and finally set errdisable recovery to automatically re-enable ports after a BPDU Guard violation.
✗1. Enter global configuration mode. 2. Configure BPDU Guard on the PortFast-enabled port. 3. Configure Root Guard on the designated port. 4. Configure Loop Guard on the non-designated port. 5. Configure errdisable recovery for BPDU Guard.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the order of guard configurations does not follow the sequence implied by the question stem (Root Guard, Loop Guard, BPDU Guard).
Why candidates choose this
Candidates might pick this because they think BPDU Guard should be configured first since it's a common protection, or they may misremember the order.
✗1. Enter global configuration mode. 2. Configure Loop Guard on the non-designated port. 3. Configure Root Guard on the designated port. 4. Configure BPDU Guard on the PortFast-enabled port. 5. Configure errdisable recovery for BPDU Guard.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the sequence does not follow the given order of the features as listed in the stem.
Why candidates choose this
Candidates might pick this because they think the order of guard configuration doesn't matter, but the question explicitly requires a specific order.
✗1. Enter global configuration mode. 2. Configure Root Guard on the designated port. 3. Configure BPDU Guard on the PortFast-enabled port. 4. Configure Loop Guard on the non-designated port. 5. Configure errdisable recovery for BPDU Guard.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the sequence does not follow the given order of the features as listed in the stem.
Why candidates choose this
Candidates might pick this because they think BPDU Guard should be configured after Root Guard but before Loop Guard, or they may confuse the order.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Bridge Protocol Data Unit
A Bridge Protocol Data Unit (BPDU) is a special message that network switches exchange to detect and prevent loops in an Ethernet network.
Key term
Root Guard
Root Guard is a Spanning Tree Protocol (STP) feature that protects the root bridge placement on a network port to prevent unauthorized switches from becoming the root bridge.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.