CCNA Switching and Network Access Practice Question
Network Topology
You are connected to a multilayer switch MLSW1. PortFast and BPDU Guard have already been enabled on interface GigabitEthernet0/1, which connects to an end device, and a BPDU received on that interface placed it in the err-disabled state. Configure Rapid PVST+ so that MLSW1 becomes the root bridge for VLAN 10 with a priority of 4096. Recover the interface by re-enabling it. Finally, verify which port is blocking on VLAN 10 by connecting to MLSW2 and executing the appropriate show command.
⚠ Common exam trap
Remember that 'spanning-tree vlan <vlan> root primary' sets priority to 24576, not a custom value. Also, err-disabled recovery requires a shutdown followed by no shutdown. Always use 'show spanning-tree vlan <vlan>' to verify port roles, not 'show interfaces status' or 'show running-config'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; shutdown; no shutdown; show spanning-tree vlan 10
The correct solution sets the spanning-tree priority for VLAN 10 to 4096 on MLSW1, ensuring it becomes the root bridge. PortFast and BPDU Guard are already configured on G0/1, which caused the interface to go err-disabled when a BPDU was received. To recover, you must issue the 'shutdown' followed by 'no shutdown' commands on the interface. Because MLSW1 is the root bridge, it has no blocking ports; the blocking port (alternate) will be seen on a downstream switch like MLSW2. Therefore, verification must be done on MLSW2 using 'show spanning-tree vlan 10' to view the alternate blocking port. Option A correctly includes all required steps. Option B uses 'root primary' (priority 24576) instead of the specified 4096, lacks the recovery commands, and verifies on the wrong device. Option C omits the err-disabled recovery and uses the wrong verification command. Option D also verifies with 'show running-config', which does not display STP port roles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; shutdown; no shutdown; show spanning-tree vlan 10
Why this is correct
This correct sequence first executes 'spanning-tree vlan 10 priority 4096', which explicitly sets the bridge priority for VLAN 10 to 4096, making the switch very likely the root bridge (default priority is 32768, and lower is better). Next, entering interface GigabitEthernet0/1 and issuing 'shutdown' followed by 'no shutdown' manually clears the err-disabled state, which is necessary because an interface placed into err-disable due to a violation like port-security can only be recovered by a link flap or an err-disable recovery mechanism. Finally, 'show spanning-tree vlan 10' is the correct verification command because it displays the STP port roles and states (including blocking/forwarding) for that VLAN, allowing you to confirm the desired blocking port on an adjacent switch.
- ✗
spanning-tree vlan 10 root primary; interface GigabitEthernet0/1; no shutdown; show spanning-tree vlan 10
Why it's wrong here
The first command 'spanning-tree vlan 10 root primary' is incorrect because it does not set the priority to 4096; instead, it configures the switch as root by setting the priority to 24576 (or to the current root's priority minus 1, if the root has a lower priority), which is not the required value of 4096. Additionally, the sequence omits the initial 'shutdown' command before 'no shutdown', so an err-disabled interface will not recover; you must first administratively shut the interface and then re-enable it to clear the err-disabled state. Although 'show spanning-tree vlan 10' is the right verification command, the preceding configuration steps are flawed, making this entire sequence invalid.
- ✗
spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; no shutdown; show interfaces status
Why it's wrong here
This is incorrect because 'no shutdown' alone does not recover an err-disabled interface; a 'shutdown' must be issued first. Also, 'show interfaces status' does not show STP blocking ports; 'show spanning-tree vlan 10' is needed.
- ✗
spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; shutdown; no shutdown; show running-config
Why it's wrong here
This option correctly applies 'spanning-tree vlan 10 priority 4096' to set the STP priority, and it also includes the proper 'shutdown' followed by 'no shutdown' cycle to recover the err-disabled interface GigabitEthernet0/1. However, the final verification command 'show running-config' is inappropriate because it only displays the saved/active configuration of the switch, not the live spanning-tree operational state. To confirm which port is blocking for VLAN 10 and to verify the STP topology, you must use 'show spanning-tree vlan 10', which shows port roles (root, designated, alternate, etc.) and states (blocking, listening, learning, forwarding). Thus, the configuration is correct, but the verification step fails to provide the needed STP interface status.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; shutdown; no shutdown; show spanning-tree vlan 10Correct answer▾
Why this is correct
This correct sequence first executes 'spanning-tree vlan 10 priority 4096', which explicitly sets the bridge priority for VLAN 10 to 4096, making the switch very likely the root bridge (default priority is 32768, and lower is better). Next, entering interface GigabitEthernet0/1 and issuing 'shutdown' followed by 'no shutdown' manually clears the err-disabled state, which is necessary because an interface placed into err-disable due to a violation like port-security can only be recovered by a link flap or an err-disable recovery mechanism. Finally, 'show spanning-tree vlan 10' is the correct verification command because it displays the STP port roles and states (including blocking/forwarding) for that VLAN, allowing you to confirm the desired blocking port on an adjacent switch.
✗spanning-tree vlan 10 root primary; interface GigabitEthernet0/1; no shutdown; show spanning-tree vlan 10Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: 'root primary' sets priority to 24576, not 4096. Also, err-disabled recovery requires a shutdown followed by no shutdown.
Why candidates choose this
Candidates pick this because 'root primary' is a common command to make a switch root, and they may think 'no shutdown' is sufficient to recover an interface.
✗spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; no shutdown; show interfaces statusWrong answer — click to see why▾
Why this is wrong here
The specific factual error: err-disabled recovery requires a shutdown before no shutdown. 'show interfaces status' does not display STP port roles.
Why candidates choose this
Candidates pick this because they know 'no shutdown' re-enables an interface, but forget that err-disabled requires a full shutdown cycle. They may also confuse 'show interfaces status' with 'show spanning-tree'.
✗spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; shutdown; no shutdown; show running-configWrong answer — click to see why▾
Why this is wrong here
The specific factual error: 'show running-config' does not display STP port roles or blocking status.
Why candidates choose this
Candidates pick this because they may think 'show running-config' verifies all configurations, but it does not show real-time STP state.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Root bridge
The root bridge is the central reference point in a Spanning Tree Protocol (STP) network, serving as the logical root of the spanning tree topology.
Key term
BPDU Guard
BPDU Guard is a Cisco switch feature that protects the network from unauthorized devices by disabling a port if it receives a Bridge Protocol Data Unit (BPDU).
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.