CCNA Switching and Network Access Practice Question
Network Topology
You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on port GigabitEthernet0/1 (designated port) to protect against superior BPDUs from an unauthorized switch, Loop Guard on uplink GigabitEthernet0/2 to prevent loops, and BPDU Guard on PortFast-enabled GigabitEthernet0/3. After configuration, a superior BPDU arrives on G0/1, blocking the port; verify the Root Guard state and ensure BPDU Guard triggers err-disable on G0/3.
⚠ Common exam trap
Do not confuse the states caused by Root Guard (root-inconsistent) and BPDU Guard (err-disable). Also, remember that Root Guard is applied to designated ports, not root or alternate ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
G0/1 is in root-inconsistent state; G0/3 is in err-disabled state.
Root Guard is needed on the designated port (G0/1) to prevent an unauthorized switch from becoming root by sending superior BPDUs. Loop Guard on the uplink (G0/2) prevents loops if BPDUs stop arriving. BPDU Guard on PortFast ports (G0/3) immediately err-disables them upon BPDU reception. The configuration uses 'spanning-tree guard root' on G0/1, 'spanning-tree guard loop' on G0/2, and 'spanning-tree bpduguard enable' on G0/3. Verification shows G0/1 blocked by root-inconsistent state and G0/3 in err-disabled state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
G0/1 is in root-inconsistent state; G0/3 is in err-disabled state.
Why this is correct
Root Guard transitions a port to root-inconsistent (blocking) when a superior BPDU is received, protecting the root bridge. BPDU Guard on a PortFast port puts the port in err-disabled state upon BPDU reception. These are the expected outcomes.
- ✗
G0/1 is in blocking state; G0/3 is in err-disabled state.
Why it's wrong here
This is incorrect because Root Guard does not put a port into the standard blocking state; it uses the root-inconsistent state. The standard blocking state is used by STP for alternate or backup ports, not by Root Guard.
- ✗
G0/1 is in root-inconsistent state; G0/3 is in blocking state.
Why it's wrong here
While G0/1 is correctly identified as root-inconsistent under Root Guard, G0/3 would not enter a standard STP blocking state when BPDU Guard is enabled. BPDU Guard is designed for PortFast ports and immediately transitions the port to err-disabled upon receiving any BPDU, placing it operationally down rather than in the blocking state used for alternative/backup ports. This err-disabled condition requires manual re-enablement or errdisable recovery configuration.
- ✗
G0/1 is in err-disabled state; G0/3 is in root-inconsistent state.
Why it's wrong here
This option incorrectly reverses the effects of the two guard mechanisms. Root Guard, when a superior BPDU arrives on G0/1, does not shut the port down; it places the port into a root-inconsistent state that discards traffic while keeping the port administratively up. Conversely, BPDU Guard on G0/3 reacts to BPDU reception by moving the PortFast port into err-disabled state, not root-inconsistent. Thus both states are swapped relative to the correct outcome.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓G0/1 is in root-inconsistent state; G0/3 is in err-disabled state.Correct answer▾
Why this is correct
Root Guard transitions a port to root-inconsistent (blocking) when a superior BPDU is received, protecting the root bridge. BPDU Guard on a PortFast port puts the port in err-disabled state upon BPDU reception. These are the expected outcomes.
✗G0/1 is in blocking state; G0/3 is in err-disabled state.Wrong answer — click to see why▾
Why this is wrong here
Root Guard uses a specific 'root-inconsistent' state, not the generic 'blocking' state.
Why candidates choose this
Candidates may confuse the root-inconsistent state with the standard STP blocking state, as both prevent traffic forwarding.
✗G0/1 is in root-inconsistent state; G0/3 is in blocking state.Wrong answer — click to see why▾
Why this is wrong here
BPDU Guard triggers err-disable, not blocking. Blocking is an STP state, not an error state.
Why candidates choose this
Candidates might think BPDU Guard puts the port into a non-forwarding STP state like blocking, but it actually disables the port entirely.
✗G0/1 is in err-disabled state; G0/3 is in root-inconsistent state.Wrong answer — click to see why▾
Why this is wrong here
Root Guard and BPDU Guard have different effects: root-inconsistent vs. err-disable. Mixing them up is a common error.
Why candidates choose this
Candidates may confuse the two guard features, especially since both are STP protection mechanisms.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Bridge Protocol Data Unit
A Bridge Protocol Data Unit (BPDU) is a special message that network switches exchange to detect and prevent loops in an Ethernet network.
Key term
BPDU
A Bridge Protocol Data Unit is a layer 2 frame that switches use to exchange information about the Spanning Tree Protocol (STP) to prevent network loops.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.