CCNA Switching and Network Access Practice Question
Network Topology
You are connected to a multilayer switch MLS1. The network has two other switches SW1 and SW2 forming a triangle topology. Currently, SW1 is the root bridge but it should be SW2. Additionally, configure PortFast and BPDU Guard on interface GigabitEthernet0/2 of MLS1, which connects to a host. Simulate a BPDU violation on that port and then recover the port from err-disabled state.
⚠ Common exam trap
Trap: Candidates may forget that the root bridge is determined by lowest priority. They might set the wrong switch to lower priority or use incorrect recovery methods like reloading or removing BPDU Guard.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
On MLS1, remove 'spanning-tree vlan 1 root primary' and set priority to 4096; on SW2, set priority to 0. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover with 'shutdown' then 'no shutdown'.
Currently, SW1 is the root bridge per the topology, but the goal is to make SW2 the root. On MLS1, removing the 'spanning-tree vlan 1 root primary' command and setting a higher priority (4096) ensures it does not interfere. On SW2, set priority to 0 to make it root. On MLS1 Gi0/2, configure PortFast and BPDU Guard. If a BPDU is received, the port goes err-disabled; to recover, issue 'shutdown' then 'no shutdown' after resolving the BPDU source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
On MLS1, remove 'spanning-tree vlan 1 root primary' and set priority to 4096; on SW2, set priority to 0. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover with 'shutdown' then 'no shutdown'.
Why this is correct
This is correct because removing the root primary command and raising MLS1's priority (e.g., 4096) ensures SW2 with lower priority (0) becomes root. PortFast and BPDU Guard are correctly applied to the host-facing port. After err-disable due to BPDU violation, 'no shutdown' re-enables the port.
- ✗
On MLS1, set priority to 0 to make it root; on SW2, set priority to 4096. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover by removing BPDU Guard.
Why it's wrong here
Assigning MLS1 priority 0 would make MLS1 the root bridge, which directly contradicts the goal of making SW2 the root because the lowest bridge ID wins STP elections. PortFast and BPDU Guard are applied correctly, so an unauthorized BPDU would err-disable Gi0/2, but removing the BPDU Guard configuration does not clear the errdisable state. The interface must be manually recovered with 'shutdown' followed by 'no shutdown' after the offending device has been removed.
- ✗
On MLS1, remove 'spanning-tree vlan 1 root primary' and set priority to 4096; on SW2, set priority to 0. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover by reloading MLS1.
Why it's wrong here
This option correctly adjusts the STP priorities: removing 'spanning-tree vlan 1 root primary' from MLS1, setting MLS1 to 4096, and setting SW2 to 0 makes SW2 the root bridge. The critical flaw is the recovery method; reloading MLS1 restarts the entire switch and disrupts all access on every VLAN, and it does nothing to eliminate the source of the invalid BPDU. After disconnecting the rogue device, the err-disabled port should be recovered by cycling the interface with 'shutdown' then 'no shutdown', not by rebooting the switch.
- ✗
On MLS1, set priority to 0; on SW2, set priority to 4096. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover with 'no shutdown'.
Why it's wrong here
The PortFast and BPDU Guard configuration on Gi0/2 is appropriate, but the priority assignments are reversed because MLS1 with priority 0 becomes root and SW2 with 4096 does not, so SW2 never wins the root election. Also, this option fails to remove the existing 'spanning-tree vlan 1 root primary' command from MLS1, leaving the switch with conflicting instructions about root status. The correct root-bridge setup is MLS1 at 4096 and SW2 at 0, and after BPDU Guard err-disables the port the interface must be re-enabled with 'shutdown' then 'no shutdown'.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓On MLS1, remove 'spanning-tree vlan 1 root primary' and set priority to 4096; on SW2, set priority to 0. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover with 'shutdown' then 'no shutdown'.Correct answer▾
Why this is correct
This is correct because removing the root primary command and raising MLS1's priority (e.g., 4096) ensures SW2 with lower priority (0) becomes root. PortFast and BPDU Guard are correctly applied to the host-facing port. After err-disable due to BPDU violation, 'no shutdown' re-enables the port.
✗On MLS1, set priority to 0 to make it root; on SW2, set priority to 4096. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover by removing BPDU Guard.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: Setting MLS1 priority to 0 makes it root, opposite of the requirement. Removing BPDU Guard does not recover the port; 'no shutdown' is needed.
Why candidates choose this
Candidates might think setting a lower priority always makes a switch root, but they overlook the requirement that SW2 should be root. They may also confuse recovery methods.
✗On MLS1, remove 'spanning-tree vlan 1 root primary' and set priority to 4096; on SW2, set priority to 0. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover by reloading MLS1.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: Reloading the switch is not the standard recovery for an err-disabled port; 'no shutdown' is the proper command.
Why candidates choose this
Candidates might think that a reload clears all errors, but it is overkill and not the recommended practice. They may not know the 'no shutdown' recovery.
✗On MLS1, set priority to 0; on SW2, set priority to 4096. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover with 'no shutdown'.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: MLS1 should have a higher priority (e.g., 4096) and SW2 a lower priority (e.g., 0) to make SW2 root. The option does the opposite.
Why candidates choose this
Candidates may confuse which switch should have the lower priority. They might think the current root should keep a low priority, but the requirement is to change the root to SW2.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
Key term
Root bridge
The root bridge is the central reference point in a Spanning Tree Protocol (STP) network, serving as the logical root of the spanning tree topology.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.