This 200-301 practice question tests your understanding of switching and network access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: bPDU Guard disables a port immediately when it receives a BPDU on a PortFast-enabled access port to prevent potential Layer 2 loops.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Interface Gi1/0/12: switchport mode access spanning-tree portfast spanning-tree bpduguard enable Status after connection: err-disabled
Exhibit: After a new switch was connected, the access-layer port went into err-disabled state immediately. Which feature most likely caused this?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Clue: "immediately / without restart"
Why it matters: Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.
Interface Gi1/0/12: switchport mode access spanning-tree portfast spanning-tree bpduguard enable Status after connection: err-disabled
Root Guard
Why wrong: Distractor.
UDLD aggressive
Why wrong: Distractor.
BPDU Guard
Correct choice.
Storm control
Why wrong: Distractor.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
BPDU Guard
BPDU Guard is the most likely cause because it immediately places a PortFast-enabled port into the err-disabled state upon receiving any BPDU, which is exactly what happens when a new switch is connected to an access port meant for end devices. Root Guard does not err-disable a port; instead, it puts the port into a root-inconsistent state when a superior BPDU is received, preventing the port from becoming a root port but still allowing traffic. UDLD aggressive can cause err-disabled states, but it is specifically designed to detect unidirectional links on fiber connections and requires a delay or misconfiguration, making it less immediate than BPDU Guard in this scenario. Storm control can err-disable a port if traffic exceeds thresholds, but this is not immediate upon connection unless a broadcast storm is already occurring, which is not indicated in the scenario.
Key principle: BPDU Guard disables a port immediately when it receives a BPDU on a PortFast-enabled access port to prevent potential Layer 2 loops.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Root Guard
Why it's wrong here
Distractor.
When this WOULD be correct
In a scenario where a switch port is configured with Root Guard and a rogue switch attempts to become the root bridge by sending BPDUs, the port would go into a blocking state to protect the network. A question could ask about the impact of Root Guard on a port when a new switch sends BPDUs.
UDLD aggressive
Why it's wrong here
Distractor.
When this WOULD be correct
If the exam question asked about a scenario where a switch port was connected to a device that was misconfigured, causing a unidirectional link, then UDLD aggressive could be the correct answer as it would disable the port to prevent network issues.
BPDU Guard
Why this is correct
Correct choice.
Clue confirmation
The clue words "most likely", "immediately / without restart" in the question point toward this answer.
Related concept
BPDU Guard disables a port immediately when it receives a BPDU on a PortFast-enabled access port to prevent potential Layer 2 loops.
Storm control
Why it's wrong here
Distractor.
When this WOULD be correct
If the question were about a switch port that was experiencing excessive broadcast traffic due to a misconfigured device, leading to the port being disabled by storm control, then this option would be correct. It would involve a scenario where traffic thresholds were exceeded, triggering storm control mechanisms.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
Correct choice.
Why this is wrong here
Root Guard does not cause a port to go into err-disabled state; instead, it places the port into a root-inconsistent state if a superior BPDU is received, blocking traffic but not disabling the port. The question describes an immediate err-disabled state, which is characteristic of BPDU Guard, not Root Guard.
★ When this WOULD be the correct answer
In a scenario where a switch port is configured with Root Guard and a rogue switch attempts to become the root bridge by sending BPDUs, the port would go into a blocking state to protect the network. A question could ask about the impact of Root Guard on a port when a new switch sends BPDUs.
Why candidates choose this
Students may confuse Root Guard with BPDU Guard because both are STP security features that react to BPDUs. However, Root Guard only prevents a port from becoming a root port, while BPDU Guard disables the port upon BPDU reception.
Why this is wrong here
UDLD aggressive mode does not immediately cause an err-disabled state upon connecting a new switch; it detects unidirectional links by sending probes and can put the port into err-disabled state only after a failure is detected, which takes time. The immediate err-disabled state suggests a feature that reacts instantly to BPDUs.
★ When this WOULD be the correct answer
If the exam question asked about a scenario where a switch port was connected to a device that was misconfigured, causing a unidirectional link, then UDLD aggressive could be the correct answer as it would disable the port to prevent network issues.
Why candidates choose this
Students may associate UDLD with err-disabled state because it can disable ports, but UDLD is for detecting unidirectional links, not for preventing unauthorized switches. The immediate reaction to a new switch connection is more indicative of BPDU Guard.
Why this is wrong here
Storm control does not cause a port to go into err-disabled state by default; it typically drops traffic exceeding a threshold or can be configured to shut down the port, but the immediate err-disabled state upon connecting a new switch is not typical for storm control. The scenario points to a feature that reacts to BPDUs, not broadcast storms.
★ When this WOULD be the correct answer
If the question were about a switch port that was experiencing excessive broadcast traffic due to a misconfigured device, leading to the port being disabled by storm control, then this option would be correct. It would involve a scenario where traffic thresholds were exceeded, triggering storm control mechanisms.
Why candidates choose this
Students might think that a new switch could cause a broadcast storm, leading to storm control triggering. However, storm control is designed to handle excessive broadcast, multicast, or unicast traffic, not the initial connection of a switch.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Be cautious not to confuse BPDU Guard with other features that cause err-disabled states, like Port Security or UDLD, which are unrelated to BPDU receipt.
Detailed technical explanation
BPDU Guard is a Cisco Catalyst switch feature designed to protect the Spanning Tree Protocol (STP) topology by disabling ports that receive Bridge Protocol Data Units (BPDUs) unexpectedly. Typically, PortFast is enabled on access ports connected to end devices to allow immediate forwarding state, bypassing the usual STP listening and learning states. However, if a BPDU is received on such a port, it indicates that another switch or device running STP is connected, which could cause loops or topology instability. When BPDU Guard is enabled on a PortFast port, the switch immediately places the port into an err-disabled state upon receiving a BPDU. This behavior prevents potential Layer 2 loops by shutting down ports that should only connect to end devices, not other switches. The port remains disabled until manually re-enabled or configured for automatic recovery. This mechanism enforces strict access-layer security and topology integrity. A common exam trap is confusing BPDU Guard with Root Guard or UDLD. Root Guard blocks ports from becoming root ports but does not err-disable the port immediately. UDLD detects unidirectional links and disables ports only under link failure conditions, unrelated to BPDUs. Storm control limits traffic rates but does not react to BPDUs. Understanding these distinctions is essential for troubleshooting err-disabled ports and designing secure network access layers.
Key takeaway
BPDU Guard disables a port immediately when it receives a BPDU on a PortFast-enabled access port to prevent potential Layer 2 loops.
Real-world example
A network engineer segments a warehouse floor into three subnets: 20 scanners, 5 printers, and 2 management hosts. Picking the wrong mask wastes addresses or leaves too few usable hosts. Exam questions test whether you can apply CIDR notation, calculate block size, and identify the correct usable-host range for a given prefix.
What to study next
Review bPDU Guard disables a port immediately when it receives a BPDU on a PortFast-enabled access port to prevent potential Layer 2 loops., then practise related 200-301 questions on the same topic to reinforce the concept.
Switching and Network Access — study guide chapter
Learn the concepts, then practise the questions
Switching and Network Access practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Switching and Network Access — This question tests Switching and Network Access — BPDU Guard disables a port immediately when it receives a BPDU on a PortFast-enabled access port to prevent potential Layer 2 loops..
The correct answer is: BPDU Guard — BPDU Guard is the most likely cause because it immediately places a PortFast-enabled port into the err-disabled state upon receiving any BPDU, which is exactly what happens when a new switch is connected to an access port meant for end devices. Root Guard does not err-disable a port; instead, it puts the port into a root-inconsistent state when a superior BPDU is received, preventing the port from becoming a root port but still allowing traffic. UDLD aggressive can cause err-disabled states, but it is specifically designed to detect unidirectional links on fiber connections and requires a delay or misconfiguration, making it less immediate than BPDU Guard in this scenario. Storm control can err-disable a port if traffic exceeds thresholds, but this is not immediate upon connection unless a broadcast storm is already occurring, which is not indicated in the scenario.
Review bPDU Guard disables a port immediately when it receives a BPDU on a PortFast-enabled access port to prevent potential Layer 2 loops., then practise related 200-301 questions on the same topic to reinforce the concept.
Yes — watch for: "most likely", "immediately / without restart". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
BPDU Guard disables a port immediately when it receives a BPDU on a PortFast-enabled access port to prevent potential Layer 2 loops.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.