CCNA Switching and Network Access Practice Question
Network Topology
You are connected to SW1. The network has experienced a spanning-tree topology change, and the new root bridge is not the intended core switch. Configure SW1 with a root primary priority, enable PortFast and BPDU Guard on interface GigabitEthernet0/3 (an edge port connected to a server), and verify that a specific port in the topology is blocking. Then, after a BPDU violation occurs on G0/3, recover the interface from err-disable state without reloading the switch.
⚠ Common exam trap
Watch out for confusing root primary vs root secondary, BPDU Guard vs BPDU filter, and the correct method to recover an err-disabled port. Manual shutdown/no shutdown is immediate, while errdisable recovery relies on a timer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
spanning-tree vlan 1 root primary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; shutdown; no shutdown
The current root bridge has priority 32769, but the intended root should be SW1 with a lower priority. First, configure SW1 as root primary using 'spanning-tree vlan 1 root primary' or manually set priority to 24576. For edge port Gi0/3, enable PortFast with 'spanning-tree portfast' and BPDU Guard with 'spanning-tree bpduguard enable'. After the BPDU violation, the port is err-disabled. To recover, first shut down and then no shut the interface, or use 'errdisable recovery cause bpduguard' and wait for the recovery interval, but the most direct method is to manually bounce the interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
spanning-tree vlan 1 root primary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; shutdown; no shutdown
Why this is correct
This sequence is fully correct. The global command 'spanning-tree vlan 1 root primary' dynamically sets SW1's bridge priority for VLAN 1 to 24576 (or lower if another switch has a lower priority), guaranteeing SW1 becomes the root bridge. Applying 'spanning-tree portfast' on GigabitEthernet0/3 transitions the port to forwarding immediately, bypassing listening/learning, which is appropriate for an access port connected to an end device. 'spanning-tree bpduguard enable' places the port in err-disabled state if a BPDU is received, protecting the STP topology. Finally, because BPDU Guard err-disables the port automatically, you must manually recover it by issuing 'shutdown' followed by 'no shutdown' on the interface—'no shutdown' alone cannot clear the err-disabled state, so bouncing the interface is the required immediate recovery step.
- ✗
spanning-tree vlan 1 priority 4096; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; errdisable recovery cause bpduguard
Why it's wrong here
This is incorrect because setting priority to 4096 is not the standard root primary method; the root primary command sets priority to 24576 or lower. Also, errdisable recovery cause bpduguard only enables automatic recovery after a timer, not immediate recovery.
- ✗
spanning-tree vlan 1 root secondary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; no shutdown
Why it's wrong here
This is incorrect because 'root secondary' sets the switch to be a backup root (priority 28672), not the primary root. Also, 'no shutdown' alone does not recover an err-disabled port; you must first shut it down.
- ✗
spanning-tree vlan 1 root primary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpdufilter enable; interface GigabitEthernet0/3; shutdown; no shutdown
Why it's wrong here
This is incorrect because BPDU filter (bpdufilter) is used to prevent sending/receiving BPDUs on a port, not to protect against BPDU violations. BPDU Guard is the correct feature to err-disable a port upon receiving a BPDU.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓spanning-tree vlan 1 root primary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; shutdown; no shutdownCorrect answer▾
Why this is correct
This sequence is fully correct. The global command 'spanning-tree vlan 1 root primary' dynamically sets SW1's bridge priority for VLAN 1 to 24576 (or lower if another switch has a lower priority), guaranteeing SW1 becomes the root bridge. Applying 'spanning-tree portfast' on GigabitEthernet0/3 transitions the port to forwarding immediately, bypassing listening/learning, which is appropriate for an access port connected to an end device. 'spanning-tree bpduguard enable' places the port in err-disabled state if a BPDU is received, protecting the STP topology. Finally, because BPDU Guard err-disables the port automatically, you must manually recover it by issuing 'shutdown' followed by 'no shutdown' on the interface—'no shutdown' alone cannot clear the err-disabled state, so bouncing the interface is the required immediate recovery step.
✗spanning-tree vlan 1 priority 4096; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; errdisable recovery cause bpduguardWrong answer — click to see why▾
Why this is wrong here
The priority value 4096 is not used by the root primary command; it sets priority to 24576. Additionally, errdisable recovery does not immediately recover the port; it requires a timer.
Why candidates choose this
Candidates may think any low priority works and that errdisable recovery is the only way to recover, but manual shutdown/no shutdown is faster and more direct.
✗spanning-tree vlan 1 root secondary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; no shutdownWrong answer — click to see why▾
Why this is wrong here
Root secondary makes the switch a secondary root, not primary. An err-disabled port requires a shutdown before no shutdown to clear the error state.
Why candidates choose this
Candidates might confuse root secondary with root primary, and think no shutdown alone can recover an err-disabled port, but the port must be cycled.
✗spanning-tree vlan 1 root primary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpdufilter enable; interface GigabitEthernet0/3; shutdown; no shutdownWrong answer — click to see why▾
Why this is wrong here
BPDU filter does not trigger err-disable on BPDU reception; it silently drops BPDUs. BPDU Guard is needed to protect edge ports.
Why candidates choose this
Candidates may confuse BPDU filter with BPDU Guard, as both are related to BPDU handling on PortFast ports, but they serve different purposes.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
PortFast
PortFast is a Cisco switch feature that immediately brings a port into the forwarding state, bypassing the normal Spanning Tree Protocol (STP) listening and learning phases, so that devices connected to that port can start communicating right away.
Key term
Bridge Protocol Data Unit
A Bridge Protocol Data Unit (BPDU) is a special message that network switches exchange to detect and prevent loops in an Ethernet network.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.