CCNA Switching and Network Access Practice Question
Exhibit
SW1# show interfaces gigabitEthernet 0/1 status Port Name Status Vlan Duplex Speed Type Gi0/1 err-disabled 1 auto auto 10/100/1000BaseTX SW1# show running-config interface gigabitEthernet 0/1 Building configuration... Current configuration : 109 bytes ! interface GigabitEthernet0/1 switchport mode access spanning-tree bpduguard enable end SW1# show spanning-tree interface gigabitEthernet 0/1 detail Port 1 (GigabitEthernet0/1) of VLAN0001 is broken (BPDU Guard) Port path cost 4, Port priority 128, Port Identifier 128.1. Designated root has priority 32768, address aaaa.bbbb.cccc Designated bridge has priority 32768, address aaaa.bbbb.cccc Designated port id is 128.1, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 BPDU: sent 0, received 3
A network engineer notices that a new switch, SW3, was connected to port GigabitEthernet0/1 on SW1, but the port immediately went into an err-disabled state. The network uses Rapid PVST+ with BPDU Guard enabled globally on all access ports. The engineer checks the logs and sees 'bpduguard error detected' messages. What is the most likely cause of the err-disabled state?
⚠ Common exam trap
Cisco often tests the confusion between BPDU Guard, Root Guard, and Loop Guard; candidates may incorrectly attribute the err-disable to Root Guard or Loop Guard, but the true cause is receiving a BPDU on a BPDU-Guard-enabled port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A BPDU was received on port GigabitEthernet0/1, triggering BPDU Guard.
The err-disabled state is caused by BPDU Guard triggering when a BPDU is received on an access port. Option A is incorrect because BPDU Guard is intentionally enabled on access ports to prevent unauthorized switches from joining the network. Option C is wrong because Root Guard prevents a port from becoming the root, not from receiving BPDUs. Option D is wrong because Loop Guard prevents loops on blocked ports in case of unidirectional links, not relevant to BPDU reception.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The port is configured as an access port, but BPDU Guard should be disabled on all access ports.
Why it's wrong here
This statement misidentifies the security control. BPDU Guard is a protection mechanism commonly enabled on access ports that should only connect to end hosts; it proactively err-disables a port upon receiving a BPDU, which would indicate an unauthorized switch. Disabling BPDU Guard on all access ports would leave the network vulnerable to rogue switches that could inject STP BPDUs, potentially altering the spanning tree topology and creating loops. The scenario describes a port that went into err-disabled state, which is exactly the intended outcome of BPDU Guard, not a misconfiguration.
- ✓
A BPDU was received on port GigabitEthernet0/1, triggering BPDU Guard.
Why this is correct
BPDU Guard is a security feature that deliberately places a port into an err-disabled state when a BPDU is received on a port where BPDU Guard is enabled, typically on an access port configured with PortFast. The port GigabitEthernet0/1 transitioning to err-disabled indicates that it received an unexpected BPDU, which suggests another switch was connected to that port. By immediately error-disabling the port, BPDU Guard prevents the unauthorized device from participating in spanning tree and disrupting the topology. This explanation directly matches the observed behavior and is the correct root cause.
- ✗
Configure Root Guard on the interface to prevent the err-disabled state.
Why it's wrong here
Root Guard is a different STP protection that does not cause an err-disabled state. It is applied to designated ports to enforce the root bridge location; if a superior BPDU is received, Root Guard moves the port into a root-inconsistent state, which blocks traffic but does not disable the interface. This behavior is distinct from BPDU Guard, which immediately err-disables the port when any BPDU arrives on an access port. Therefore, enabling Root Guard would not prevent the observed err-disabled condition and would not address the underlying trigger.
- ✗
Enable Loop Guard on the interface to prevent the err-disabled state.
Why it's wrong here
Loop Guard is designed to handle unidirectional link failures by preventing a non-designated port from transitioning to the designated state after BPDUs stop being received. It places the port into a loop-inconsistent state rather than an err-disabled state, and it acts on the loss of BPDUs, not on receipt of BPDUs. In this scenario, the port became err-disabled because a BPDU was received on an access port, which is precisely the condition that triggers BPDU Guard. Loop Guard is therefore irrelevant to this error condition.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓A BPDU was received on port GigabitEthernet0/1, triggering BPDU Guard.Correct answer▾
Why this is correct
BPDU Guard is a security feature that deliberately places a port into an err-disabled state when a BPDU is received on a port where BPDU Guard is enabled, typically on an access port configured with PortFast. The port GigabitEthernet0/1 transitioning to err-disabled indicates that it received an unexpected BPDU, which suggests another switch was connected to that port. By immediately error-disabling the port, BPDU Guard prevents the unauthorized device from participating in spanning tree and disrupting the topology. This explanation directly matches the observed behavior and is the correct root cause.
✗The port is configured as an access port, but BPDU Guard should be disabled on all access ports.Wrong answer — click to see why▾
Why this is wrong here
BPDU Guard is correctly enabled on access ports; the issue is that an authorized switch was connected, so the guard was triggered unintentionally.
✗Configure Root Guard on the interface to prevent the err-disabled state.Wrong answer — click to see why▾
Why this is wrong here
Root Guard does not address the BPDU reception issue; it only affects root bridge selection.
✗Enable Loop Guard on the interface to prevent the err-disabled state.Wrong answer — click to see why▾
Why this is wrong here
Loop Guard would not have prevented the err-disabled; it is used for different scenarios.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Access port
An access port is a switch port that connects to a single end device, like a computer or printer, and carries traffic for only one VLAN.
Key term
Root Guard
Root Guard is a Spanning Tree Protocol (STP) feature that protects the root bridge placement on a network port to prevent unauthorized switches from becoming the root bridge.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.