Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Switching and Network Access Practice Question
Drag and drop the following steps into the correct order to configure Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports, and then recover a port that enters err-disabled due to BPDU Guard.
⚠ Common exam trap
Cisco exams often test the specific port roles for each STP protection feature. Remember: Root Guard is for designated ports, Loop Guard is for non-designated ports (alternate/backup), and BPDU Guard is for PortFast ports. Also, recovery from err-disabled due to BPDU Guard requires manual interface reset, not just waiting or removing the configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Recover a port in err-disabled state due to BPDU Guard by shutting it down and re-enabling it.
The correct order begins with Root Guard on designated ports to prevent them from becoming root ports upon receiving superior BPDUs. Next, Loop Guard is applied to non-designated ports (alternate/backup) to protect against unidirectional link failures. Then, BPDU Guard is placed on PortFast-enabled ports to shut them down if a BPDU is received, preventing rogue switch connections. Finally, recovery from BPDU Guard err-disable requires a manual interface reset (shutdown/no shutdown) because the errdisable cause 'bpduguard' has no automatic timeout.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Recover a port in err-disabled state due to BPDU Guard by shutting it down and re-enabling it.
Why this is correct
This order correctly follows the standard sequence: Root Guard is applied to designated ports to prevent them from becoming root ports, Loop Guard is applied to non-designated ports to prevent alternate/backup ports from transitioning to forwarding due to BPDU loss, and BPDU Guard is applied to PortFast ports to protect against unexpected BPDUs. Recovery from err-disabled state due to BPDU Guard requires an interface reset (shutdown/no shutdown).
- ✗
1. Configure BPDU Guard on designated ports. 2. Configure Root Guard on non-designated ports. 3. Configure Loop Guard on PortFast ports. 4. Recover a port in err-disabled state by reloading the switch.
Why it's wrong here
This is incorrect because BPDU Guard is applied to PortFast ports, not designated ports; Root Guard is applied to designated ports, not non-designated ports; Loop Guard is applied to non-designated ports, not PortFast ports; and recovery from err-disabled state due to BPDU Guard requires an interface reset, not a switch reload.
- ✗
1. Configure Loop Guard on designated ports. 2. Configure BPDU Guard on non-designated ports. 3. Configure Root Guard on PortFast ports. 4. Recover a port in err-disabled state by waiting for the errdisable timeout.
Why it's wrong here
This is incorrect because Loop Guard is applied to non-designated ports, not designated ports; BPDU Guard is applied to PortFast ports, not non-designated ports; Root Guard is applied to designated ports, not PortFast ports; and while errdisable recovery can be automated, the manual recovery method is shutdown/no shutdown, not just waiting.
- ✗
1. Configure Root Guard on non-designated ports. 2. Configure Loop Guard on designated ports. 3. Configure BPDU Guard on all ports. 4. Recover a port in err-disabled state by removing BPDU Guard configuration.
Why it's wrong here
This is incorrect because Root Guard is applied to designated ports, not non-designated ports; Loop Guard is applied to non-designated ports, not designated ports; BPDU Guard is applied only to PortFast ports, not all ports; and removing BPDU Guard does not recover the port—it must be manually reset.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Recover a port in err-disabled state due to BPDU Guard by shutting it down and re-enabling it.Correct answer▾
Why this is correct
This order correctly follows the standard sequence: Root Guard is applied to designated ports to prevent them from becoming root ports, Loop Guard is applied to non-designated ports to prevent alternate/backup ports from transitioning to forwarding due to BPDU loss, and BPDU Guard is applied to PortFast ports to protect against unexpected BPDUs. Recovery from err-disabled state due to BPDU Guard requires an interface reset (shutdown/no shutdown).
✗1. Configure BPDU Guard on designated ports. 2. Configure Root Guard on non-designated ports. 3. Configure Loop Guard on PortFast ports. 4. Recover a port in err-disabled state by reloading the switch.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is misassignment of STP protection features to the wrong port roles and an incorrect recovery method.
Why candidates choose this
Candidates might confuse the port roles for each feature or think that a switch reload is a valid recovery method for err-disabled ports.
✗1. Configure Loop Guard on designated ports. 2. Configure BPDU Guard on non-designated ports. 3. Configure Root Guard on PortFast ports. 4. Recover a port in err-disabled state by waiting for the errdisable timeout.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is misassignment of STP protection features to the wrong port roles and an incomplete recovery method.
Why candidates choose this
Candidates might think that errdisable timeout automatically recovers the port without manual intervention, or they may confuse the port roles for each feature.
✗1. Configure Root Guard on non-designated ports. 2. Configure Loop Guard on designated ports. 3. Configure BPDU Guard on all ports. 4. Recover a port in err-disabled state by removing BPDU Guard configuration.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is misassignment of STP protection features to the wrong port roles and an incorrect recovery method.
Why candidates choose this
Candidates might think that BPDU Guard should be applied to all ports for maximum protection, or that removing the cause of err-disable is sufficient for recovery.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Root Guard
Root Guard is a Spanning Tree Protocol (STP) feature that protects the root bridge placement on a network port to prevent unauthorized switches from becoming the root bridge.
Key term
Loop Guard
Loop Guard is a Spanning Tree Protocol (STP) enhancement that prevents network loops by placing a blocked port into a loop-inconsistent state if it stops receiving Bridge Protocol Data Units (BPDUs), rather than transitioning it to a forwarding state.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.