This 200-301 practice question tests your understanding of switching and network access. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: bPDU Guard immediately disables a PortFast-enabled access port upon receiving a BPDU to prevent Layer 2 loops caused by unauthorized switches.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit: A user reports intermittent connectivity after a new switch was connected to an access port. Which feature would have prevented this by immediately disabling the port when a BPDU was received?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "immediately / without restart"
Why it matters: Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.
Root Guard
Why wrong: Root Guard stops a port from becoming a root port, but it does not simply err-disable any PortFast edge port on BPDU reception.
Loop Guard
Why wrong: Loop Guard protects against unidirectional link issues on non-designated ports.
BPDU Guard
BPDU Guard is the standard protection for PortFast access ports.
UDLD
Why wrong: UDLD checks fiber or point-to-point link directionality, not BPDUs from an unexpected switch.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
BPDU Guard
BPDU Guard is the correct answer because it protects PortFast-enabled edge ports by immediately disabling the port upon receiving a BPDU, preventing accidental loops. Root Guard prevents the port from becoming a root port, not from BPDU reception. Loop Guard prevents alternate or root ports from becoming designated due to BPDU loss, unrelated to BPDU reception disabling. UDLD detects unidirectional links but does not disable ports upon BPDU reception.
Key principle: BPDU Guard immediately disables a PortFast-enabled access port upon receiving a BPDU to prevent Layer 2 loops caused by unauthorized switches.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Root Guard
Why it's wrong here
Root Guard stops a port from becoming a root port, but it does not simply err-disable any PortFast edge port on BPDU reception.
When this WOULD be correct
In a different question, if the scenario involved preventing a non-root switch from becoming the root bridge while allowing the existing root bridge to maintain its status, Root Guard would be the correct answer. For example, if a user was asked how to secure the root bridge in a network with multiple switches, Root Guard would be appropriate.
Loop Guard
Why it's wrong here
Loop Guard protects against unidirectional link issues on non-designated ports.
When this WOULD be correct
In a different question, if the scenario involved a network topology where a switch was incorrectly configured and caused a loop, asking about preventing loops without specifying immediate port disablement could make Loop Guard the correct answer, as it would maintain stability by preventing loops.
BPDU Guard
Why this is correct
BPDU Guard is the standard protection for PortFast access ports.
Clue confirmation
The clue word "immediately / without restart" in the question point toward this answer.
Related concept
BPDU Guard immediately disables a PortFast-enabled access port upon receiving a BPDU to prevent Layer 2 loops caused by unauthorized switches.
UDLD
Why it's wrong here
UDLD checks fiber or point-to-point link directionality, not BPDUs from an unexpected switch.
When this WOULD be correct
In a scenario where a question asks about how to prevent unidirectional links from causing network issues, and it specifies that a port should be disabled when a unidirectional link is detected, UDLD would be the correct answer.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
BPDU Guard is the standard protection for PortFast access ports.
Why this is wrong here
Root Guard is designed to prevent a non-root switch from becoming the root bridge in a spanning tree topology by blocking ports that receive BPDUs from non-root devices. However, it does not disable the port immediately upon receiving a BPDU, which is the requirement in this scenario.
★ When this WOULD be the correct answer
In a different question, if the scenario involved preventing a non-root switch from becoming the root bridge while allowing the existing root bridge to maintain its status, Root Guard would be the correct answer. For example, if a user was asked how to secure the root bridge in a network with multiple switches, Root Guard would be appropriate.
Why candidates choose this
Candidates may confuse Root Guard with BPDU Guard due to their similar functions related to BPDUs, leading them to mistakenly believe that Root Guard also provides immediate port shutdown capabilities.
Why this is wrong here
Loop Guard is designed to prevent loops in a network by keeping a port in a loop-inconsistent state if it stops receiving BPDUs. However, it does not disable the port upon receiving a BPDU, which is the requirement in this scenario.
★ When this WOULD be the correct answer
In a different question, if the scenario involved a network topology where a switch was incorrectly configured and caused a loop, asking about preventing loops without specifying immediate port disablement could make Loop Guard the correct answer, as it would maintain stability by preventing loops.
Why candidates choose this
Candidates may choose Loop Guard because they associate it with BPDU handling and network stability, leading them to believe it could address issues related to connectivity and loops, despite it not directly disabling ports upon BPDU reception.
Why this is wrong here
UDLD (Unidirectional Link Detection) is designed to detect unidirectional links and disable the port if it identifies one, but it does not specifically address the issue of BPDUs being received on an access port, which is the focus of the question.
★ When this WOULD be the correct answer
In a scenario where a question asks about how to prevent unidirectional links from causing network issues, and it specifies that a port should be disabled when a unidirectional link is detected, UDLD would be the correct answer.
Why candidates choose this
Candidates may confuse UDLD with BPDU Guard due to both being related to link stability and port management, leading them to mistakenly believe UDLD could also prevent issues caused by BPDUs.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Be cautious not to confuse BPDU Guard with other guard features like Root Guard or Loop Guard, which serve different purposes.
Detailed technical explanation
BPDU Guard is a Cisco Spanning Tree Protocol (STP) feature designed to protect access ports configured with PortFast. PortFast allows ports connected to end devices to bypass the usual STP listening and learning states, enabling faster network connectivity. However, if a switch or bridge is accidentally connected to a PortFast-enabled port, it can send Bridge Protocol Data Units (BPDUs), which may cause Layer 2 loops and network instability. BPDU Guard mitigates this risk by immediately err-disabling the port upon receipt of any BPDU, effectively shutting down the port to prevent loops. The decision process behind BPDU Guard is straightforward: when a PortFast-enabled port receives a BPDU, it assumes a misconfiguration or unauthorized device connection. Unlike Root Guard, which blocks ports from becoming root ports but keeps them operational, BPDU Guard takes a more aggressive approach by disabling the port entirely. Loop Guard, on the other hand, protects against unidirectional link failures on non-designated ports but does not err-disable ports on BPDU reception. UDLD focuses on physical link integrity rather than STP BPDU handling. A common exam trap is confusing BPDU Guard with Root Guard or Loop Guard. Root Guard blocks superior BPDUs to protect the root bridge but does not shut down the port. Loop Guard prevents STP topology changes due to unidirectional link failures but does not disable ports on BPDU receipt. BPDU Guard’s unique behavior of err-disabling a PortFast port on BPDU receipt is critical for preventing accidental bridging loops in access layer networks. Practically, network administrators must monitor err-disabled ports and configure errdisable recovery to restore connectivity after resolving the issue.
Key takeaway
BPDU Guard immediately disables a PortFast-enabled access port upon receiving a BPDU to prevent Layer 2 loops caused by unauthorized switches.
Real-world example
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Review bPDU Guard immediately disables a PortFast-enabled access port upon receiving a BPDU to prevent Layer 2 loops caused by unauthorized switches., then practise related 200-301 questions on the same topic to reinforce the concept.
Switching and Network Access — study guide chapter
Learn the concepts, then practise the questions
Switching and Network Access practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Switching and Network Access — This question tests Switching and Network Access — BPDU Guard immediately disables a PortFast-enabled access port upon receiving a BPDU to prevent Layer 2 loops caused by unauthorized switches..
The correct answer is: BPDU Guard — BPDU Guard is the correct answer because it protects PortFast-enabled edge ports by immediately disabling the port upon receiving a BPDU, preventing accidental loops. Root Guard prevents the port from becoming a root port, not from BPDU reception. Loop Guard prevents alternate or root ports from becoming designated due to BPDU loss, unrelated to BPDU reception disabling. UDLD detects unidirectional links but does not disable ports upon BPDU reception.
Review bPDU Guard immediately disables a PortFast-enabled access port upon receiving a BPDU to prevent Layer 2 loops caused by unauthorized switches., then practise related 200-301 questions on the same topic to reinforce the concept.
Yes — watch for: "immediately / without restart". Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.
BPDU Guard immediately disables a PortFast-enabled access port upon receiving a BPDU to prevent Layer 2 loops caused by unauthorized switches.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.