CCNA Switching and Network Access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Root Guard, when enabled on a port, prevents that port from becoming the root port by placing it in a root-inconsistent state if a superior BPDU is received.

  Why this is correct

  Root Guard, enabled on a designated port, does not prevent the switch from receiving a superior BPDU; instead, it reacts by moving the port into a root-inconsistent state, which blocks all traffic on that port while the superior BPDU continues to arrive. Once the superior BPDUs stop, the port automatically returns to its normal designated role. This behavior keeps an unauthorized switch from becoming the root bridge, but it does not disable the port or require manual intervention.

• ✗

  Root Guard automatically shuts down the port when a superior BPDU is received, similar to BPDU Guard.

  Why it's wrong here

  The claim that Root Guard shuts down the port like BPDU Guard is incorrect. BPDU Guard moves the port to errdisable state, but Root Guard never errdisables the interface; it places the port in a root-inconsistent (blocking) state only as long as the superior BPDU is received. When the superior BPDU disappears, the port immediately resumes forwarding, so no manual recovery or administrative shutdown is involved.

• ✗

  Loop Guard, when enabled, disables a port if BPDUs are no longer received on it, preventing a unidirectional link failure.

  Why it's wrong here

  This option misstates Loop Guard's behavior and purpose. Loop Guard does not disable (errdisable) a port; rather, when a root or alternate port stops receiving BPDUs — typically because of a unidirectional link failure — it transitions that port to a loop-inconsistent state, which is a blocking state that still allows BPDUs to be sent. Moreover, Loop Guard does not prevent the physical link failure itself; it only prevents the bridging loop that would occur if the switch incorrectly made that port designated and started forwarding.

• ✓

  BPDU Guard, when enabled, puts the port in an errdisable state if a BPDU is received, which is typically used on access ports to prevent unauthorized switches from connecting.

  Why this is correct

  BPDU Guard is a PortFast enhancement that protects access ports from rogue switch connections. When a BPDU is received on a port with BPDU Guard enabled, the switch immediately places that port in errdisable state, blocking all traffic and disabling the port, which requires either manual re-enable or automatic recovery via errdisable timeout. It is commonly applied to access ports that should never receive BPDUs, so any BPDU indicates an unauthorized switch trying to participate in spanning tree.

• ✗

  BPDU Guard places the port in a blocking state (loop-inconsistent) when a BPDU is received, similar to Loop Guard.

  Why it's wrong here

  BPDU Guard does not place the port in an STP blocking or 'loop-inconsistent' state like Loop Guard; it takes much more aggressive action by placing the interface in errdisable state. The loop-inconsistent state is used by Loop Guard when a port stops receiving BPDUs, and it does not involve BPDU reception. This option inverts the two mechanisms and incorrectly claims that BPDU Guard behaves similarly to Loop Guard.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question