Courseiva
← 200-301
Full test
Switching and Network Access →hardTroubleshootingObjective-mapped

CCNA Switching and Network Access Practice Question

Exhibit

R1#show running-config | section interface
interface GigabitEthernet1/0/1
 description Uplink to Core
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet1/0/2
 description Uplink to Core
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet1/0/3
 description Potential Root Port
 switchport access vlan 10
 switchport mode access
 spanning-tree guard root
!
interface GigabitEthernet1/0/4
 description Server
 switchport access vlan 10
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet1/0/5
 description Desktop
 switchport access vlan 10
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
!
R1#show spanning-tree vlan 10
VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    4097
             Address     0011.2233.4455
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    4097   (priority 4096 sys-id-ext 1)
             Address     0011.2233.4455
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi1/0/1          Desg FWD 4         128.1    Shr
Gi1/0/2          Desg FWD 4         128.2    Shr
Gi1/0/3          Desg BKN*4         128.3    Shr  *ROOT_Guard
Gi1/0/4          Desg FWD 4         128.4    Shr  Edge
Gi1/0/5          Desg FWD 4         128.5    Shr  Edge

R1#show interfaces status | include err-disabled
Gi1/0/5           err-disabled   auto   auto  10/100/1000

You are securing the spanning-tree topology on R1, the root bridge for VLAN 10. Intended configurations: Root Guard on GigabitEthernet1/0/3, Loop Guard on gigabit interfaces 1/0/1 and 1/0/2, and BPDU Guard on all PortFast-enabled interfaces. After initial configuration, a superior BPDU on G1/0/3 blocks the port (expected), and a host on G1/0/5 triggers BPDU Guard, causing err-disable (expected). However, you realize Loop Guard was not applied to the uplinks. Troubleshoot and apply the missing configuration.

⚠ Common exam trap

Do not assume that a blocked port due to Root Guard is a problem; it is intentional. Also, do not confuse BPDU Guard with BPDU Filter; BPDU Guard err-disables, while BPDU Filter suppresses BPDUs. Remember that err-disabled ports must be manually re-enabled with 'no shutdown'.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure Loop Guard on G1/0/1 and G1/0/2 with 'spanning-tree guard loop' and recover G1/0/5 from err-disable by issuing 'shutdown' followed by 'no shutdown'.

The candidate must first identify that Root Guard is correctly configured on G1/0/3, causing it to block (BKN*ROOT_Guard) upon receiving a superior BPDU, which is correct behavior. However, the task states to protect the root bridge role; since R1 is already root, Root Guard is appropriate. The err-disabled port G1/0/5 indicates BPDU Guard triggered; this is expected because a host connected to a PortFast port sent a BPDU. To resolve, the candidate should re-enable the port with 'no shutdown' and ensure BPDU Guard is properly applied. Additionally, Loop Guard is missing on uplinks G1/0/1 and G1/0/2; it must be configured with 'spanning-tree guard loop' under each interface. No changes to Root Guard are needed; the blockage is intentional.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Remove Root Guard from G1/0/3 and configure it with 'spanning-tree guard loop' to prevent the blockage.

    Why it's wrong here

    This is incorrect because Root Guard on G1/0/3 is performing its intended function: it places the port into a root-inconsistent state when a superior BPDU is received, thereby blocking the unauthorized switch from becoming root. Removing Root Guard would allow that switch to alter the spanning-tree topology, violating the requirement to protect the root bridge. Loop Guard addresses a different failure mode — it prevents alternate or root ports from forwarding data when BPDUs are silently lost on a healthy link — and would not stop the superior BPDU from being accepted, so it cannot resolve the blockage caused by Root Guard.

  • ✗

    Re-enable G1/0/5 with 'no shutdown' and apply 'spanning-tree bpduguard enable' on all PortFast-enabled interfaces to prevent future err-disable.

    Why it's wrong here

    This is incorrect because BPDU Guard is already enabled on PortFast interfaces (as per the task), and the err-disable occurred because a host sent a BPDU. Re-enabling the port is necessary, but BPDU Guard should remain; the issue is that the host should not be sending BPDUs.

  • ✓

    Configure Loop Guard on G1/0/1 and G1/0/2 with 'spanning-tree guard loop' and recover G1/0/5 from err-disable by issuing 'shutdown' followed by 'no shutdown'.

    Why this is correct

    This is correct because Loop Guard is missing on the uplinks, which is required by the task. Additionally, G1/0/5 is in err-disable state due to BPDU Guard; it must be re-enabled with 'no shutdown'. Root Guard on G1/0/3 is correct and should remain.

  • ✗

    Remove BPDU Guard from all PortFast interfaces and configure 'spanning-tree portfast bpdufilter default' to prevent err-disable.

    Why it's wrong here

    This is incorrect because BPDU Filter would suppress BPDUs, which could lead to loops. The task requires BPDU Guard to be applied, and the err-disable is a protective measure. Removing BPDU Guard or using BPDU Filter is not the correct resolution.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

✓Configure Loop Guard on G1/0/1 and G1/0/2 with 'spanning-tree guard loop' and recover G1/0/5 from err-disable by issuing 'shutdown' followed by 'no shutdown'.Correct answer▾

Why this is correct

This is correct because Loop Guard is missing on the uplinks, which is required by the task. Additionally, G1/0/5 is in err-disable state due to BPDU Guard; it must be re-enabled with 'no shutdown'. Root Guard on G1/0/3 is correct and should remain.

✗Remove Root Guard from G1/0/3 and configure it with 'spanning-tree guard loop' to prevent the blockage.Wrong answer — click to see why▾

Why this is wrong here

Root Guard is designed to block a port that receives superior BPDUs, which is exactly what happened. The configuration is correct and should not be removed.

Why candidates choose this

Candidates may think that any blocked port is a problem and needs to be fixed by changing the guard type, not realizing that Root Guard's purpose is to block in this scenario.

✗Re-enable G1/0/5 with 'no shutdown' and apply 'spanning-tree bpduguard enable' on all PortFast-enabled interfaces to prevent future err-disable.Wrong answer — click to see why▾

Why this is wrong here

BPDU Guard is correctly configured; the err-disable is expected behavior when a BPDU is received on a PortFast port. The solution is to re-enable the port and ensure the host is not a switch.

Why candidates choose this

Candidates might think that BPDU Guard should be removed or that the configuration is missing, but it is already applied and working as designed.

✗Remove BPDU Guard from all PortFast interfaces and configure 'spanning-tree portfast bpdufilter default' to prevent err-disable.Wrong answer — click to see why▾

Why this is wrong here

BPDU Filter is not a substitute for BPDU Guard; it prevents the port from sending or receiving BPDUs, which can cause bridging loops. The correct action is to re-enable the port, not change the protection mechanism.

Why candidates choose this

Candidates may confuse BPDU Guard with BPDU Filter, thinking that filtering BPDUs would prevent the err-disable, but this compromises network stability.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Client Recursive Resolver Root DNS (13 root servers) TLD DNS (.com, .org, …) Authoritative example.com query IP addr answer

About these practice questions

Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.