CCNA Switching and Network Access Practice Question
Network Topology
You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on the designated port facing a downstream switch to prevent a rogue switch from becoming root. Also, enable Loop Guard on the uplink port to prevent STP loops, and configure BPDU Guard on a PortFast-enabled access port. Ensure that if a superior BPDU is received on the Root Guard port, it is blocked, and if a BPDU is received on the BPDU Guard port, it goes err-disabled.
⚠ Common exam trap
The trap is that candidates may think changes are needed because they misapply STP protections to the wrong port types. Remember: Root Guard on designated ports, Loop Guard on root/alternate ports, BPDU Guard on PortFast access ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The configuration is correct; no changes are needed.
R1 is the STP root for VLAN 10. The downstream port (G0/1) is a designated port, so Root Guard is correctly applied to prevent a superior BPDU from being accepted. The uplink port (G0/0) is a root port, so Loop Guard should be applied there to prevent an STP loop if BPDUs stop arriving. The access port (G0/2) has PortFast and BPDU Guard enabled, which will err-disable the port if a BPDU is received. The current configuration is correct; no changes are needed. If a superior BPDU arrives on G0/1, Root Guard will block the port. If a BPDU arrives on G0/2, BPDU Guard will err-disable it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The configuration is correct; no changes are needed.
Why this is correct
Root Guard on G0/1 (designated port) blocks superior BPDUs, Loop Guard on G0/0 (root port) prevents loops if BPDUs stop, and BPDU Guard on G0/2 (PortFast access port) err-disables on BPDU reception. All features are correctly applied per best practices.
- ✗
Root Guard should be applied on G0/0 instead of G0/1, and Loop Guard on G0/1 instead of G0/0.
Why it's wrong here
Applying Root Guard to G0/0 (the root port) would cause the port to err-disable whenever it legitimately receives a superior BPDU from the current root bridge, defeating its purpose. Loop Guard on G0/1 (a designated port) would incorrectly place the port into the blocking/inconsistent state if BPDUs stop arriving, even though designated ports are expected to originate BPDUs rather than depend on received ones. Root Guard belongs on designated ports, and Loop Guard belongs on root/alternate ports—swapping them creates failure domains instead of protection.
- ✗
BPDU Guard should be configured on G0/1 instead of G0/2, and Loop Guard should be removed from G0/0.
Why it's wrong here
This is incorrect because BPDU Guard is for access ports with PortFast, not for trunk or designated ports. Loop Guard is correctly applied on the root port (G0/0) to prevent loops if BPDUs stop arriving.
- ✗
Root Guard should be applied on G0/2 instead of G0/1, and BPDU Guard should be removed from G0/2.
Why it's wrong here
This is incorrect because Root Guard is not appropriate for an access port; it is for designated ports on trunks or inter-switch links. BPDU Guard is correctly used on PortFast access ports to protect against rogue BPDUs.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The configuration is correct; no changes are needed.Correct answer▾
Why this is correct
Root Guard on G0/1 (designated port) blocks superior BPDUs, Loop Guard on G0/0 (root port) prevents loops if BPDUs stop, and BPDU Guard on G0/2 (PortFast access port) err-disables on BPDU reception. All features are correctly applied per best practices.
✗Root Guard should be applied on G0/0 instead of G0/1, and Loop Guard on G0/1 instead of G0/0.Wrong answer — click to see why▾
Why this is wrong here
Root Guard is only effective on designated ports; applying it to a root port would not prevent a rogue switch from becoming root. Loop Guard on a designated port is unnecessary and could cause false positives.
Why candidates choose this
Candidates often confuse which STP protection goes on which port type, thinking Root Guard should be on the root port to protect it, but it actually protects downstream designated ports.
✗BPDU Guard should be configured on G0/1 instead of G0/2, and Loop Guard should be removed from G0/0.Wrong answer — click to see why▾
Why this is wrong here
BPDU Guard on a trunk port would err-disable it upon receiving a BPDU, which is normal for trunk ports. Loop Guard on the root port is essential for loop prevention; removing it would leave the network vulnerable.
Why candidates choose this
Candidates might think BPDU Guard should be on all ports to prevent BPDU attacks, but it is specifically for PortFast-enabled access ports. They may also underestimate the importance of Loop Guard on root ports.
✗Root Guard should be applied on G0/2 instead of G0/1, and BPDU Guard should be removed from G0/2.Wrong answer — click to see why▾
Why this is wrong here
Root Guard on an access port would block the port if a superior BPDU is received, but access ports should not receive BPDUs if PortFast is enabled. BPDU Guard already handles that by err-disabling the port.
Why candidates choose this
Candidates might think Root Guard provides additional protection on access ports, but it is redundant and misapplied. They may also confuse the purpose of Root Guard and BPDU Guard.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Root Guard
Root Guard is a Spanning Tree Protocol (STP) feature that protects the root bridge placement on a network port to prevent unauthorized switches from becoming the root bridge.
Key term
BPDU Guard
BPDU Guard is a Cisco switch feature that protects the network from unauthorized devices by disabling a port if it receives a Bridge Protocol Data Unit (BPDU).
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.