CCNA Switching and Network Access Practice Question
Exhibit
MLS1# show spanning-tree
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 32769
Address aabb.cc00.0100
This bridge is the root
Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)
Address aabb.cc00.0100
Interface Role Sts Cost Prio.Nbr Type
------------------- --- --- --------- -------- --------------------------------
Gi0/0 Desg FWD 4 128.1 P2p
Gi0/1 Desg FWD 4 128.2 P2p
Gi0/2 Desg FWD 4 128.3 P2p
Gi0/2 is connected to SW2. Gi0/1 is uplink to core. Gi0/0 is access port with PortFast enabled.
MLS1# show running-config | section interface
interface GigabitEthernet0/0
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet0/1
switchport mode trunk
!
interface GigabitEthernet0/2
switchport mode trunk
!You are connected to a multilayer switch MLS1. Configure Root Guard on the designated port facing another switch SW2 to prevent it from becoming root, configure Loop Guard on the uplink port to the core, and configure BPDU Guard on a PortFast-enabled access port. After configuration, a superior BPDU arrives on the designated port—confirm it is blocked by Root Guard. Then, simulate a BPDU on the access port to verify it goes err-disabled due to BPDU Guard.
⚠ Common exam trap
Do not confuse the purposes of Root Guard, Loop Guard, and BPDU Guard. Root Guard blocks superior BPDUs on designated ports; Loop Guard prevents loops on root/alternate ports; BPDU Guard err-disables PortFast ports upon BPDU reception. Pay attention to port roles: designated, root, and access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Root Guard on Gi0/2, Loop Guard on Gi0/1, BPDU Guard on Gi0/0
First, Root Guard was applied on Gi0/2 (the designated port) with 'spanning-tree guard root' to prevent SW2 from becoming root. Second, Loop Guard was applied on the uplink Gi0/1 with 'spanning-tree guard loop' to protect against unidirectional links. Third, BPDU Guard was applied on the PortFast-enabled access port Gi0/0 with 'spanning-tree bpduguard enable'. When a superior BPDU arrives on Gi0/2, Root Guard transitions it to a root-inconsistent (blocked) state. If a BPDU is received on Gi0/0, BPDU Guard err-disables the port. Verification shows the blocked state on Gi0/2 and err-disabled on Gi0/0.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Root Guard on Gi0/2, Loop Guard on Gi0/1, BPDU Guard on Gi0/0
Why this is correct
This configuration correctly applies Root Guard on the designated port (Gi0/2) to block superior BPDUs, Loop Guard on the uplink (Gi0/1) to prevent loops from unidirectional links, and BPDU Guard on the PortFast-enabled access port (Gi0/0) to err-disable upon BPDU reception.
- ✗
Root Guard on Gi0/1, Loop Guard on Gi0/2, BPDU Guard on Gi0/0
Why it's wrong here
This is incorrect because Root Guard should be applied on the designated port facing SW2 (Gi0/2), not on the uplink to the core (Gi0/1). Loop Guard should be on the uplink, not on the designated port.
- ✗
Root Guard on Gi0/0, Loop Guard on Gi0/1, BPDU Guard on Gi0/2
Why it's wrong here
This is incorrect because Root Guard should not be on an access port (Gi0/0) as it is PortFast-enabled and not expected to receive BPDUs; BPDU Guard is more appropriate there. BPDU Guard on Gi0/2 would err-disable the designated port upon receiving a superior BPDU, which is not the intended behavior.
- ✗
Root Guard on Gi0/2, Loop Guard on Gi0/0, BPDU Guard on Gi0/1
Why it's wrong here
This answer correctly places Root Guard on the designated port Gi0/2, but it misassigns the two remaining protections. Loop Guard is intended for root or alternate blocking ports, where a unidirectional link could cause a stale blocking state; an access port like Gi0/0 is not a blocking port and is better protected by BPDU Guard because it is PortFast-enabled. Placing BPDU Guard on the uplink Gi0/1 would improperly err-disable a legitimate switch-to-switch link if a normal BPDU is received, defeating its purpose of protecting end-user access ports.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Root Guard on Gi0/2, Loop Guard on Gi0/1, BPDU Guard on Gi0/0Correct answer▾
Why this is correct
This configuration correctly applies Root Guard on the designated port (Gi0/2) to block superior BPDUs, Loop Guard on the uplink (Gi0/1) to prevent loops from unidirectional links, and BPDU Guard on the PortFast-enabled access port (Gi0/0) to err-disable upon BPDU reception.
✗Root Guard on Gi0/1, Loop Guard on Gi0/2, BPDU Guard on Gi0/0Wrong answer — click to see why▾
Why this is wrong here
Root Guard is intended for ports that should not become root; applying it on the uplink would block legitimate superior BPDUs from the core. Loop Guard on the designated port would not protect against unidirectional links on the uplink.
Why candidates choose this
Candidates may confuse which port is designated versus uplink, or think Root Guard should be on all ports.
✗Root Guard on Gi0/0, Loop Guard on Gi0/1, BPDU Guard on Gi0/2Wrong answer — click to see why▾
Why this is wrong here
Root Guard on an access port is unnecessary and would not prevent the switch from becoming root via other ports. BPDU Guard on the designated port would disable it instead of blocking the BPDU.
Why candidates choose this
Candidates might think Root Guard is a general protection and apply it to all ports, or confuse the functions of Root Guard and BPDU Guard.
✗Root Guard on Gi0/2, Loop Guard on Gi0/0, BPDU Guard on Gi0/1Wrong answer — click to see why▾
Why this is wrong here
Loop Guard on an access port does not protect against unidirectional links on the uplink. BPDU Guard on the uplink would err-disable the core connection if a BPDU is received, which is undesirable.
Why candidates choose this
Candidates may misplace Loop Guard and BPDU Guard due to misunderstanding of where unidirectional links or BPDU threats occur.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Designated port
In a Spanning Tree Protocol network, a Designated port is the port on a network segment that has the best path to the root bridge and is responsible for forwarding traffic toward the root bridge.
Key term
Root Guard
Root Guard is a Spanning Tree Protocol (STP) feature that protects the root bridge placement on a network port to prevent unauthorized switches from becoming the root bridge.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.