CCNA Switching and Network Access Practice Question
Exhibit
SW1# show interfaces status Port Name Status Vlan Duplex Speed Type Gi0/1 err-disabled 10 auto auto 10/100/1000BaseTX Gi0/2 err-disabled 10 auto auto 10/100/1000BaseTX Gi0/3 err-disabled 10 auto auto 10/100/1000BaseTX Gi0/4 err-disabled 10 auto auto 10/100/1000BaseTX Gi0/5 connected trunk auto auto 10/100/1000BaseTX Gi0/6 connected 1 auto auto 10/100/1000BaseTX Gi0/7 connected 1 auto auto 10/100/1000BaseTX SW1# show running-config interface gi0/1 Building configuration... Current configuration : 83 bytes ! interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 spanning-tree bpduguard enable end SW1# show running-config | include bpduguard spanning-tree portfast bpduguard default
A network administrator recently configured BPDU Guard on all access ports of a switch to protect against rogue switches. After the change, users in VLAN 10 report intermittent connectivity issues and frequent link flaps. The administrator checks the switch and notices that several ports are in an err-disabled state. What is the most likely cause of the problem?
⚠ Common exam trap
A common mistake is believing BPDU Guard requires PortFast to function; in reality, BPDU Guard can be enabled per-interface without PortFast and will err-disable the port when a BPDU is received.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BPDU Guard is enabled on access ports that are receiving BPDUs, causing the ports to go into err-disabled state.
BPDU Guard is configured to protect against rogue switches by placing a port into an err-disabled state upon receiving a BPDU. In this scenario, BPDU Guard is enabled on access ports that are receiving BPDUs (possibly from a rogue switch or misconfiguration), causing the ports to err-disable and flap. PortFast is not required for BPDU Guard to function; the issue is that BPDUs are being received on ports that are not expected to receive them. The intermittent connectivity occurs as ports cycle into err-disabled and are re-enabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Root Guard is preventing the port from becoming a root port.
Why it's wrong here
Root Guard does not generate err-disabled; it forces an interface into the root-inconsistent state when a superior BPDU is received, blocking traffic until the offending BPDUs cease. Unlike err-disabled, this condition clears automatically without manual intervention, and the port remains administratively up. Therefore, while Root Guard prevents the port from becoming a root port, it cannot explain the err-disabled status.
- ✓
BPDU Guard is enabled on access ports that are receiving BPDUs, causing the ports to go into err-disabled state.
Why this is correct
BPDU Guard is a security feature that intentionally places a PortFast-enabled access port into err-disabled when any BPDU is received, protecting against rogue switches attempting to participate in spanning tree. When an unauthorized device sends BPDUs, the switch immediately disables the port and logs an error, requiring an administrator to manually re-enable it or rely on errdisable recovery. This matches the scenario where access ports receiving BPDUs are error-disabled.
- ✗
Loop Guard has detected a unidirectional link and placed the port into err-disabled state.
Why it's wrong here
Loop Guard addresses unidirectional links by monitoring the absence of BPDUs on root or alternate ports, and it transitions the port to a loop-inconsistent blocking state, not err-disabled. The loop-inconsistent state is a spanning-tree state that recovers automatically once BPDUs are seen again, whereas err-disabled requires manual re-enabling or a timer. Since Loop Guard does not have an err-disable action, this option is incorrect.
- ✗
BPDU Guard is globally enabled but not configured on the interface, so the port is err-disabled due to a BPDU received.
Why it's wrong here
The global spanning-tree bpduguard default command only applies to interfaces that also have PortFast enabled; it does not affect regular access ports unless per-interface spanning-tree bpduguard enable is configured. If BPDU Guard were only global and the port were not PortFast, receiving a BPDU would not cause err-disabled. Thus, the interface must have explicit per-port BPDU Guard configuration to enter the err-disabled state, making this option's premise incorrect.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓BPDU Guard is enabled on access ports that are receiving BPDUs, causing the ports to go into err-disabled state.Correct answer▾
Why this is correct
BPDU Guard is a security feature that intentionally places a PortFast-enabled access port into err-disabled when any BPDU is received, protecting against rogue switches attempting to participate in spanning tree. When an unauthorized device sends BPDUs, the switch immediately disables the port and logs an error, requiring an administrator to manually re-enable it or rely on errdisable recovery. This matches the scenario where access ports receiving BPDUs are error-disabled.
✗Root Guard is preventing the port from becoming a root port.Wrong answer — click to see why▾
Why this is wrong here
Root Guard prevents a port from becoming a root port by placing it in a root-inconsistent state, not err-disabled. It does not cause link flaps or err-disable ports.
Why candidates choose this
Students may confuse Root Guard with BPDU Guard because both are STP security features, and the term 'guard' suggests protection, leading to the assumption that it could cause err-disable.
✗Loop Guard has detected a unidirectional link and placed the port into err-disabled state.Wrong answer — click to see why▾
Why this is wrong here
Loop Guard prevents alternate or root ports from becoming designated in the absence of BPDUs, but it does not err-disable ports. It places ports in a loop-inconsistent state, which is not err-disabled.
Why candidates choose this
Loop Guard also deals with BPDU issues and can cause port blocking, so students might mistakenly think it causes err-disable, especially since both features are related to STP protection.
✗BPDU Guard is globally enabled but not configured on the interface, so the port is err-disabled due to a BPDU received.Wrong answer — click to see why▾
Why this is wrong here
The global 'spanning-tree portfast bpduguard default' command only applies BPDU Guard to PortFast-enabled ports. If a port receives a BPDU and is not PortFast, it will not be err-disabled by this global command. The scenario states BPDU Guard was configured on all access ports, implying interface-level configuration.
Why candidates choose this
Students may not fully understand the difference between global and interface BPDU Guard configuration, and might think global application alone can cause err-disable on any port receiving a BPDU.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
Key term
VLAN
A VLAN logically segments a physical network into isolated broadcast domains without requiring separate physical switches.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.