CCNA Switching and Network Access Practice Question
Which TWO statements correctly describe the behavior of Root Guard, Loop Guard, and BPDU Guard in a Rapid PVST+ environment?
⚠ Common exam trap
Cisco often tests the misconception that Loop Guard immediately forwards traffic when BPDUs stop, but in reality it blocks the port to prevent loops, and that Root Guard and BPDU Guard can coexist on the same port, which they cannot due to conflicting behaviors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Root Guard is applied to a port that should never become a root port; if a superior BPDU is received, the port is placed into a root-inconsistent state.
Root Guard, applied to a port that should never become a root port, places that port into a root-inconsistent state upon receiving a superior BPDU, blocking traffic to prevent an unauthorized root bridge. Option C is correct because BPDU Guard is typically configured on access ports and error-disables the port if any BPDU is received, protecting against rogue switch connections. Option B is incorrect: when BPDUs stop on a port with Loop Guard, the port is placed into a loop-inconsistent state (blocked), not immediately forwarded, to prevent loops. Option D is incorrect because Root Guard and BPDU Guard are mutually exclusive and cannot be enabled simultaneously on the same port due to conflicting protective behaviors. Option E is incorrect because Loop Guard is effective on any port that is expected to receive BPDUs, including root ports and alternate/backup ports; it is not limited to ports already in a blocking state, and the statement's use of 'only' makes it false.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Root Guard is applied to a port that should never become a root port; if a superior BPDU is received, the port is placed into a root-inconsistent state.
Why this is correct
Root Guard is placed on designated ports that should never become root ports. It allows normal BPDU processing, but if a superior BPDU (one with a lower bridge ID than the current root) is received, the port transitions to a root-inconsistent state, which blocks traffic while still listening for BPDUs. This prevents an unauthorized or misconfigured switch from becoming the spanning-tree root. Unlike BPDU Guard, the port automatically recovers once the superior BPDUs cease, without manual intervention.
- ✗
Loop Guard is used on root ports to monitor BPDU reception; if BPDUs stop, the port is immediately placed into forwarding mode to maintain connectivity.
Why it's wrong here
Loop Guard does not apply to root ports; root ports are active forwarding ports that receive BPDUs from the root bridge. Loop Guard is designed for non-designated ports (alternate or backup) that are in a blocking state. When a unidirectional link failure stops BPDU arrival, Loop Guard forces the port into a loop-inconsistent state—a blocked state—rather than letting it move to forwarding, which would create a bridging loop. Thus the claim that it immediately forwards is the exact opposite of its actual function.
- ✓
BPDU Guard is typically configured on access ports and error-disables the port if a BPDU is received, protecting against unauthorized switch connections.
Why this is correct
BPDU Guard is a PortFast companion feature applied to access ports, which are not expected to receive BPDUs. If any BPDU is received, it signals that another switch or bridging device has been attached, so the port is immediately error-disabled to prevent a potential loop and unauthorized network access. This errdisable state can be cleared manually or via automatic recovery mechanisms like 'errdisable recovery cause bpduguard'. It does not filter BPDUs; it reacts to them by shutting the port down.
- ✗
Root Guard and BPDU Guard can be enabled simultaneously on the same port to provide both root protection and BPDU filtering.
Why it's wrong here
This is incorrect. Root Guard and BPDU Guard have conflicting effects on a port. Root Guard allows BPDU processing (to detect superior BPDUs), while BPDU Guard disables the port upon receiving any BPDU. They cannot be used together on the same port.
- ✗
Loop Guard is only effective when configured on ports that are in a blocking state; it prevents them from transitioning to forwarding if BPDUs are not received.
Why it's wrong here
Loop Guard is applied to ports that are in a blocking state (alternate or backup ports). If BPDUs stop arriving, the port stays in a loop-inconsistent state (blocked) rather than transitioning to forwarding, thus preventing loops.
When this WOULD be correct
When you want to prevent temporary loops caused by unidirectional link failures on blocked ports.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Root Guard is applied to a port that should never become a root port; if a superior BPDU is received, the port is placed into a root-inconsistent state.Correct answer▾
Why this is correct
Root Guard is placed on designated ports that should never become root ports. It allows normal BPDU processing, but if a superior BPDU (one with a lower bridge ID than the current root) is received, the port transitions to a root-inconsistent state, which blocks traffic while still listening for BPDUs. This prevents an unauthorized or misconfigured switch from becoming the spanning-tree root. Unlike BPDU Guard, the port automatically recovers once the superior BPDUs cease, without manual intervention.
✗Loop Guard is used on root ports to monitor BPDU reception; if BPDUs stop, the port is immediately placed into forwarding mode to maintain connectivity.Wrong answer — click to see why▾
Why this is wrong here
Loop Guard is applied to non-designated ports (alternate or backup ports), not root ports. When BPDUs stop arriving, the port is placed into a loop-inconsistent state (blocked) to prevent loops, not into forwarding mode.
Why candidates choose this
Students may confuse Loop Guard with UplinkFast or other features that quickly transition ports to forwarding. They might think Loop Guard is used on root ports to maintain connectivity if BPDUs are lost, but its actual purpose is to prevent loops by keeping ports blocked.
✗Root Guard and BPDU Guard can be enabled simultaneously on the same port to provide both root protection and BPDU filtering.Wrong answer — click to see why▾
Why this is wrong here
Root Guard and BPDU Guard have conflicting behaviors: Root Guard allows BPDU processing to detect superior BPDUs, while BPDU Guard disables the port upon receiving any BPDU. They cannot be enabled simultaneously on the same port because their actions are mutually exclusive.
Why candidates choose this
Students might think that combining both features provides comprehensive protection, but they overlook the fact that BPDU Guard would error-disable the port before Root Guard can act, making Root Guard ineffective.
✗Loop Guard is only effective when configured on ports that are in a blocking state; it prevents them from transitioning to forwarding if BPDUs are not received.Wrong answer — click to see why▾
Why this is wrong here
Loop Guard is effective on ports that are in a blocking state (alternate or backup ports), but it does not prevent them from transitioning to forwarding; instead, if BPDUs stop, the port remains in a loop-inconsistent state (blocked) to prevent loops. The statement incorrectly implies that Loop Guard prevents transition, but it actually causes the port to stay blocked.
★ When this WOULD be the correct answer
When you want to prevent temporary loops caused by unidirectional link failures on blocked ports.
Why candidates choose this
Students may understand that Loop Guard is used on blocking ports but misinterpret its behavior. They might think it prevents the port from transitioning to forwarding, which is partially true, but the key is that it keeps the port blocked when BPDUs are lost, not that it prevents transition in general.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
BPDU Guard
BPDU Guard is a Cisco switch feature that protects the network from unauthorized devices by disabling a port if it receives a Bridge Protocol Data Unit (BPDU).
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.