CCNA Switching and Network Access Practice Question
Exhibit
R1# show running-config | section interface
interface GigabitEthernet0/0
no switchport
ip address 192.0.2.1 255.255.255.252
!
interface GigabitEthernet0/1
switchport mode trunk
spanning-tree guard root
!
interface GigabitEthernet0/2
switchport mode trunk
spanning-tree loopguard default
!
interface GigabitEthernet0/3
switchport mode access
switchport access vlan 10
spanning-tree portfast
spanning-tree bpduguard enable
!
R1# show spanning-tree root
VLAN0001
Root ID Priority 32769
Address 0001.1111.1111
This bridge is the root
R1# show interfaces status | include err-disabled
GigabitEthernet0/3 err-disabledYou are connected to R1, a multilayer switch acting as the STP root bridge. Configure Root Guard on the designated port toward R2 (G0/1), Loop Guard on the uplink port G0/2, and BPDU Guard on PortFast-enabled access port G0/3. After configuration, a superior BPDU is received on G0/1, causing it to be blocked by Root Guard; later, an unauthorized BPDU on G0/3 triggers err-disable. Troubleshoot and verify the expected port states.
⚠ Common exam trap
Do not confuse the actions of Root Guard (blocking) with BPDU Guard (err-disable). Root Guard blocks the port temporarily; BPDU Guard err-disables the port until manual intervention. Also, Loop Guard does not block immediately; it only reacts when BPDUs stop.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
G0/1 is in blocking state (Root Guard), G0/2 is in forwarding state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).
The root guard on G0/1 correctly blocked the port when a superior BPDU was received, preventing an unauthorized root bridge. Loop Guard was applied specifically to the uplink port G0/2 to prevent forwarding loops in case of uni-directional link failure. BPDU Guard on G0/3 placed the port into err-disable state upon receiving an unexpected BPDU, which protects the PortFast edge port. To restore G0/3, you must manually shut/no shut the interface after removing the offending device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
G0/1 is in blocking state (Root Guard), G0/2 is in forwarding state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).
Why this is correct
Root Guard forces a designated port to block if a superior BPDU is received, preventing an unauthorized root bridge. Loop Guard on G0/2 keeps the port in forwarding state as long as BPDUs are received; if BPDUs stop, it transitions to loop-inconsistent blocking. BPDU Guard on a PortFast-enabled access port places the port in err-disable state upon receiving any BPDU, protecting the edge port.
- ✗
G0/1 is in forwarding state (Root Guard), G0/2 is in blocking state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).
Why it's wrong here
This is incorrect because Root Guard does not allow the port to forward when a superior BPDU is received; it blocks the port. Loop Guard does not block the port immediately; it only blocks if BPDUs stop being received. Here, BPDUs are still being received, so G0/2 should be forwarding.
- ✗
G0/1 is in err-disable state (Root Guard), G0/2 is in forwarding state (Loop Guard), G0/3 is in blocking state (BPDU Guard).
Why it's wrong here
This is incorrect because Root Guard does not place the port in err-disable; it blocks the port while the superior BPDU is received, and the port recovers automatically when the superior BPDU stops. BPDU Guard places the port in err-disable, not blocking state.
- ✗
G0/1 is in blocking state (Root Guard), G0/2 is in loop-inconsistent state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).
Why it's wrong here
This is incorrect because Loop Guard only transitions to loop-inconsistent blocking state when BPDUs are no longer received. In this scenario, BPDUs are still being received on G0/2, so it remains in forwarding state. The question does not indicate a unidirectional link failure.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓G0/1 is in blocking state (Root Guard), G0/2 is in forwarding state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).Correct answer▾
Why this is correct
Root Guard forces a designated port to block if a superior BPDU is received, preventing an unauthorized root bridge. Loop Guard on G0/2 keeps the port in forwarding state as long as BPDUs are received; if BPDUs stop, it transitions to loop-inconsistent blocking. BPDU Guard on a PortFast-enabled access port places the port in err-disable state upon receiving any BPDU, protecting the edge port.
✗G0/1 is in forwarding state (Root Guard), G0/2 is in blocking state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).Wrong answer — click to see why▾
Why this is wrong here
Root Guard blocks the port upon receiving a superior BPDU, not forwards. Loop Guard transitions to blocking only after BPDU loss, not while BPDUs are still received.
Why candidates choose this
Candidates may confuse Root Guard with BPDU Guard, thinking it err-disables, or think Loop Guard always blocks the port.
✗G0/1 is in err-disable state (Root Guard), G0/2 is in forwarding state (Loop Guard), G0/3 is in blocking state (BPDU Guard).Wrong answer — click to see why▾
Why this is wrong here
Root Guard results in a blocking state, not err-disable. BPDU Guard results in err-disable, not blocking.
Why candidates choose this
Candidates may think Root Guard err-disables because it's a security feature, or confuse the actions of Root Guard and BPDU Guard.
✗G0/1 is in blocking state (Root Guard), G0/2 is in loop-inconsistent state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).Wrong answer — click to see why▾
Why this is wrong here
Loop Guard does not immediately place the port in loop-inconsistent state; it only does so after BPDU loss. Here, BPDUs are still being received.
Why candidates choose this
Candidates may think Loop Guard always puts the port in a special state, but it only activates upon BPDU loss.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Bridge Protocol Data Unit
A Bridge Protocol Data Unit (BPDU) is a special message that network switches exchange to detect and prevent loops in an Ethernet network.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.