CCNA Switching and Network Access Practice Question
Exhibit
interface g1/0/24 switchport mode access spanning-tree portfast spanning-tree bpduguard enable
SW1 is the root bridge for VLAN 10. A user switch receives a BPDU on an access port connected to a desk-side unmanaged switch. What should happen if BPDU Guard is enabled on that port?
⚠ Common exam trap
Remember that BPDU Guard actively disables ports, it doesn't just log or ignore BPDUs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The port is moved to err-disabled state
BPDU Guard is designed to protect edge ports. If a BPDU is received on a PortFast access port, the switch places the interface into the err-disabled state to stop a potential Layer 2 loop or rogue switch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The port transitions to forwarding more quickly
Why it's wrong here
PortFast alone accelerates the access port's transition from blocking to forwarding after link-up, bypassing the normal listening and learning delays. BPDU Guard, however, has nothing to do with that initial speed-up; it is a protective response to an unexpected BPDU after the port is already operational. Receiving a BPDU triggers error-disable, not an even faster forwarding state, so this answer mischaracterizes the purpose of the feature.
When this WOULD be correct
In a different scenario, if the question asked about a switch port that is configured with Rapid Spanning Tree Protocol (RSTP) and receives a BPDU, one might mistakenly think that the port would transition to forwarding mode due to the rapid convergence feature of RSTP, making this option appear correct.
- ✓
The port is moved to err-disabled state
Why this is correct
When BPDU Guard is enabled on a PortFast edge access port, receiving any BPDU is considered a violation because a legitimate end host should never generate BPDUs. The switch immediately places the port into the err-disabled state, effectively shutting it down to prevent a rogue switch from participating in VLAN 10 spanning tree. This protects the root bridge's topology by blocking the unauthorized device at the access layer.
- ✗
The switch elects a new root bridge
Why it's wrong here
STP root bridge election is decided by bridge ID (priority + MAC) among switches exchanging BPDUs, and a single BPDU received on one edge port would not cause SW1, the existing root, to be replaced. Moreover, BPDU Guard's action is to disable the port before the received BPDU can influence spanning-tree calculations, so no re-election occurs; the unauthorized BPDU is dropped from consideration.
When this WOULD be correct
In a different scenario where a question asks about the behavior of a switch when a BPDU is received on a port configured as a root port or in a situation where a switch is actively participating in Spanning Tree Protocol (STP), the switch may elect a new root bridge if it determines that the received BPDU indicates a better root bridge candidate.
- ✗
The port becomes a trunk automatically
Why it's wrong here
Becoming a trunk is controlled by DTP or explicit switchport mode trunk negotiation, not by STP protection mechanisms. BPDU Guard works at the spanning-tree layer and only responds to BPDUs by placing the port in err-disabled; it does not modify the access port's administrative mode. An access port with BPDU Guard remains an access port, and the port is shut down rather than converted into a trunk.
When this WOULD be correct
In a different scenario where a switch is configured to automatically negotiate trunking on a port and receives a specific configuration BPDU indicating a trunking request, the port could transition to trunk mode. The question would need to focus on trunk negotiation protocols like DTP (Dynamic Trunking Protocol) rather than BPDU Guard.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The port is moved to err-disabled stateCorrect answer▾
Why this is correct
When BPDU Guard is enabled on a PortFast edge access port, receiving any BPDU is considered a violation because a legitimate end host should never generate BPDUs. The switch immediately places the port into the err-disabled state, effectively shutting it down to prevent a rogue switch from participating in VLAN 10 spanning tree. This protects the root bridge's topology by blocking the unauthorized device at the access layer.
✗The port transitions to forwarding more quicklyWrong answer — click to see why▾
Why this is wrong here
PortFast allows a port to transition to forwarding immediately upon link up, but it does not react to BPDU reception. BPDU Guard is a separate feature that disables the port upon receiving a BPDU, not accelerate forwarding.
★ When this WOULD be the correct answer
In a different scenario, if the question asked about a switch port that is configured with Rapid Spanning Tree Protocol (RSTP) and receives a BPDU, one might mistakenly think that the port would transition to forwarding mode due to the rapid convergence feature of RSTP, making this option appear correct.
Why candidates choose this
Students often confuse PortFast and BPDU Guard because both are commonly applied to edge ports. Since PortFast speeds up forwarding, they might think BPDU Guard also does something similar when a BPDU is received.
✗The switch elects a new root bridgeWrong answer — click to see why▾
Why this is wrong here
Receiving a BPDU on a single edge port does not trigger a root bridge election. Root bridge election is based on bridge ID comparison across the entire spanning-tree domain, not on a single BPDU on a port.
★ When this WOULD be the correct answer
In a different scenario where a question asks about the behavior of a switch when a BPDU is received on a port configured as a root port or in a situation where a switch is actively participating in Spanning Tree Protocol (STP), the switch may elect a new root bridge if it determines that the received BPDU indicates a better root bridge candidate.
Why candidates choose this
Test-takers may think that any BPDU reception can influence root bridge selection, especially if they confuse BPDU Guard with root guard. Root guard prevents a port from becoming a root port, but BPDU Guard simply disables the port.
✗The port becomes a trunk automaticallyWrong answer — click to see why▾
Why this is wrong here
BPDU Guard does not change the port mode; it only reacts to BPDU reception by disabling the port. Port mode (access or trunk) is configured separately and is not affected by STP protection features.
★ When this WOULD be the correct answer
In a different scenario where a switch is configured to automatically negotiate trunking on a port and receives a specific configuration BPDU indicating a trunking request, the port could transition to trunk mode. The question would need to focus on trunk negotiation protocols like DTP (Dynamic Trunking Protocol) rather than BPDU Guard.
Why candidates choose this
Some might think that because BPDUs are typically sent on trunk ports, receiving a BPDU on an access port would cause the switch to automatically convert it to a trunk. However, this is not how STP protections work.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Bridge Protocol Data Unit
A Bridge Protocol Data Unit (BPDU) is a special message that network switches exchange to detect and prevent loops in an Ethernet network.
Key term
Err-disabled
Err-disabled is a switch port state that occurs when the switch detects a critical error on that port and automatically shuts it down to protect the network.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.