CCNA Switching and Network Access Practice Question
Which TWO statements correctly describe the configuration and effect of Root Guard and BPDU Guard on a Cisco switch?
⚠ Common exam trap
Cisco often tests the distinction between the states triggered by Root Guard (root-inconsistent) versus BPDU Guard (errdisable), and candidates frequently confuse the two, assuming both place the port into errdisable or that Root Guard uses errdisable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Root Guard is configured on a per-port basis and causes the port to become root-inconsistent if a superior BPDU is received.
Root Guard is configured per interface using the 'spanning-tree guard root' command. When a port with Root Guard enabled receives a superior BPDU (one that would cause the switch to become a non-root bridge), the port is placed into a root-inconsistent state, effectively blocking traffic on that port and preventing the switch from accepting a new root bridge from that direction. This protects the spanning-tree topology from unauthorized or misconfigured switches attempting to become the root bridge. Option D is correct because BPDU Guard is commonly enabled on ports with PortFast (typically access ports connected to end devices). When a BPDU is received on such a port, BPDU Guard places the port into errdisable state, preventing potential bridging loops that could result from an unauthorized switch connecting to the network. Option B is incorrect because BPDU Guard does not prevent loops by disabling a trunk port; it is typically used on access ports (often with PortFast) and disables the port upon receiving any BPDU, not just on trunk ports. Option C is incorrect because Root Guard places the port into root-inconsistent state (not errdisable) when a superior BPDU is received; BPDU Guard uses errdisable. Option E is incorrect because neither Root Guard nor BPDU Guard filters BPDUs; Root Guard reacts to superior BPDUs by blocking the port, and BPDU Guard reacts to any BPDU by disabling the port. Both features allow BPDUs to be processed but then take action based on the received BPDUs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Root Guard is configured on a per-port basis and causes the port to become root-inconsistent if a superior BPDU is received.
Why this is correct
Root Guard is configured per interface, usually on designated ports, to enforce the current root bridge location. When a port receives a superior BPDU, Root Guard changes the port to a root-inconsistent state, which is a blocking state for all traffic. This prevents an unauthorized switch from taking over as root, and the port resumes normal forwarding automatically after the superior BPDUs cease. It does not require errdisable or manual recovery, as it is not a security violation.
- ✗
BPDU Guard prevents loops by disabling a trunk port that receives a BPDU from an unauthorized switch.
Why it's wrong here
BPDU Guard is applied to access ports (often with PortFast) and places the port in errdisable state if any BPDU is received; it does not target trunk ports or specifically prevent loops—that is the role of Loop Guard.
- ✗
Root Guard places a port in errdisable state when a superior BPDU is received.
Why it's wrong here
Root Guard does not use errdisable; instead, it transitions the port to a root-inconsistent state when a superior BPDU is received. This special state blocks all traffic on the port, but unlike errdisable, it is not a failure condition requiring manual intervention. The port automatically returns to normal operation once the superior BPDUs stop arriving, making Root Guard a proactive safeguard for designated ports.
- ✓
BPDU Guard is commonly enabled on ports where PortFast is configured to prevent unexpected BPDUs from causing a bridging loop.
Why this is correct
PortFast bypasses Spanning Tree Protocol convergence on access ports, immediately transitioning them to forwarding. This creates a vulnerability because any BPDU received on such a port could signal a loop or an unauthorized switch. BPDU Guard is therefore commonly enabled in conjunction with PortFast to error-disable the port upon BPDU reception, instantly cutting off the potential loop. It is a standard security and stability practice for edge ports.
- ✗
Both Root Guard and BPDU Guard filter BPDUs to prevent them from being processed by the switch CPU.
Why it's wrong here
Neither Root Guard nor BPDU Guard filters BPDUs. Root Guard reacts to superior BPDUs by changing port state, and BPDU Guard reacts by error-disabling the port. They do not prevent BPDUs from reaching the CPU.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Root Guard is configured on a per-port basis and causes the port to become root-inconsistent if a superior BPDU is received.Correct answer▾
Why this is correct
Root Guard is configured per interface, usually on designated ports, to enforce the current root bridge location. When a port receives a superior BPDU, Root Guard changes the port to a root-inconsistent state, which is a blocking state for all traffic. This prevents an unauthorized switch from taking over as root, and the port resumes normal forwarding automatically after the superior BPDUs cease. It does not require errdisable or manual recovery, as it is not a security violation.
✗BPDU Guard prevents loops by disabling a trunk port that receives a BPDU from an unauthorized switch.Wrong answer — click to see why▾
Why this is wrong here
BPDU Guard is applied to access ports (often with PortFast) and places the port in errdisable state if any BPDU is received. It does not target trunk ports; trunk ports are expected to receive BPDUs. The feature that prevents loops by disabling a port that receives BPDUs on a trunk is actually Loop Guard, not BPDU Guard.
Why candidates choose this
Students may confuse BPDU Guard with Loop Guard because both deal with BPDUs and loop prevention. The mention of 'trunk port' and 'unauthorized switch' might lead them to think BPDU Guard is used on trunks, but BPDU Guard is specifically for access ports.
✗Root Guard places a port in errdisable state when a superior BPDU is received.Wrong answer — click to see why▾
Why this is wrong here
Root Guard does not place a port in errdisable state; it uses a root-inconsistent state. The errdisable state is used by BPDU Guard and other features like UDLD. Root Guard's root-inconsistent state allows automatic recovery when superior BPDUs stop, whereas errdisable requires manual intervention or errdisable recovery configuration.
Why candidates choose this
Both Root Guard and BPDU Guard react to BPDUs, and students may mistakenly think both use errdisable. The term 'errdisable' is commonly associated with port security violations, so it's easy to confuse with Root Guard's action.
✗Both Root Guard and BPDU Guard filter BPDUs to prevent them from being processed by the switch CPU.Wrong answer — click to see why▾
Why this is wrong here
Neither Root Guard nor BPDU Guard filters BPDUs. Root Guard reacts to superior BPDUs by changing the port state, but the BPDU is still processed by the switch CPU. BPDU Guard reacts by error-disabling the port, but the BPDU is still received and processed. Filtering BPDUs is done by BPDU Filter, not these features.
Why candidates choose this
The word 'Guard' might imply protection by filtering, and students may think both features prevent BPDUs from reaching the CPU. However, they are reactive mechanisms, not filters. BPDU Filter is a separate feature that actually prevents BPDU transmission and reception.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
PortFast
PortFast is a Cisco switch feature that immediately brings a port into the forwarding state, bypassing the normal Spanning Tree Protocol (STP) listening and learning phases, so that devices connected to that port can start communicating right away.
Key term
Root Guard
Root Guard is a Spanning Tree Protocol (STP) feature that protects the root bridge placement on a network port to prevent unauthorized switches from becoming the root bridge.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.