The correct answer is to configure interface G0/3 with spanning-tree portfast and spanning-tree bpduguard enable, then manually recover the port with shutdown and no shutdown. This is necessary because BPDU Guard places a port into an err-disabled state when it receives a BPDU on a PortFast-enabled edge port, which is exactly what happened when the PC sent unexpected BPDUs. On the CCNA 200-301 v2 exam, this scenario tests your understanding of spanning-tree edge port security and the recovery procedure from BPDU Guard err-disabled; a common trap is forgetting that enabling PortFast and BPDU Guard does not automatically bring the port back up—you must manually cycle the interface. The blocked port on SW2 is G0/2, identified by its Altn BLK role in the spanning-tree output. Memory tip: “Fast Guard needs a manual nudge” — PortFast and BPDU Guard stop the threat, but only a shutdown/no-shutdown restores the port.
CCNA Switching and Network Access Practice Question
This 200-301 practice question tests your understanding of switching and network access. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Network Topology
You are connected to SW1 via the console. The network has three switches connected in a triangle: SW1 (G0/1 to SW2 G0/1), SW1 (G0/2 to SW3 G0/1), and SW2 (G0/2 to SW3 G0/2). SW1 is the root bridge. A PC is connected to SW3's G0/3 port, which should be an edge port. However, the PC has been sending BPDUs, causing the port to go err-disabled. Configure SW3 to prevent this in the future: enable PortFast and BPDU Guard on G0/3. Then, verify that the port recovers from err-disabled state and that a specific blocked port on SW2 is identified. Use the provided show output to determine the current state and necessary commands.
SW3# show interfaces status
Port Name Status Vlan Duplex Speed Type
Gi0/1 connected 1 a-full a-1000 10/100/1000BaseTX
Gi0/2 connected 1 a-full a-1000 10/100/1000BaseTX
Gi0/3 err-disabled 1 auto auto 10/100/1000BaseTX
SW3# show spanning-tree
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 24577
Address 0001.1111.1111
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)
Address 0001.1111.1111
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/1 Desg FWD 4 128.1 P2p
Gi0/2 Desg FWD 4 128.2 P2p
Gi0/3 Desg BKN*4 128.3 P2p *PVID_Inc
SW2# show spanning-tree
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 24577
Address 0001.1111.1111
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)
Address 0002.2222.2222
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/1 Root FWD 4 128.1 P2p
Gi0/2 Altn BLK 4 128.2 P2p
A
interface g0/3
spanning-tree portfast
spanning-tree bpduguard enable
shutdown
no shutdown
This sequence correctly enables PortFast and BPDU Guard on the interface, then manually recovers the err-disabled port by issuing shutdown followed by no shutdown. PortFast makes the port an edge port, and BPDU Guard disables it if a BPDU is received, preventing future err-disable events.
B
interface g0/3
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
Why wrong: This is incorrect because after enabling BPDU Guard, the port is already in err-disabled state and will not recover without a manual shutdown/no shutdown cycle. Simply issuing 'no shutdown' without first shutting down the interface will not clear the err-disabled state.
Why wrong: This is incorrect because saving the configuration does not recover the err-disabled port. The port remains in err-disabled state until manually recovered with shutdown/no shutdown. The commands do not include the necessary recovery steps.
Why wrong: This is incorrect because only shutting down the interface leaves it in a shutdown state; it does not recover the port. A subsequent 'no shutdown' is required to bring the interface back up.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
interface g0/3
spanning-tree portfast
spanning-tree bpduguard enable
shutdown
no shutdown
The PC connected to SW3's G0/3 was sending BPDUs, causing the port to go err-disabled due to BPDU Guard. To prevent this, enable PortFast and BPDU Guard on that interface. First, move to interface configuration mode for G0/3, then issue 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After configuration, the port will remain err-disabled until manually recovered by issuing 'shutdown' followed by 'no shutdown'. The blocked port on SW2 is G0/2, as shown by the 'Altn BLK' role/status in its spanning-tree output.
Key principle: Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
interface g0/3
spanning-tree portfast
spanning-tree bpduguard enable
shutdown
no shutdown
Why this is correct
This sequence correctly enables PortFast and BPDU Guard on the interface, then manually recovers the err-disabled port by issuing shutdown followed by no shutdown. PortFast makes the port an edge port, and BPDU Guard disables it if a BPDU is received, preventing future err-disable events.
Related concept
Authentication checks who the user is.
✗
interface g0/3
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
Why it's wrong here
This is incorrect because after enabling BPDU Guard, the port is already in err-disabled state and will not recover without a manual shutdown/no shutdown cycle. Simply issuing 'no shutdown' without first shutting down the interface will not clear the err-disabled state.
This is incorrect because saving the configuration does not recover the err-disabled port. The port remains in err-disabled state until manually recovered with shutdown/no shutdown. The commands do not include the necessary recovery steps.
This is incorrect because only shutting down the interface leaves it in a shutdown state; it does not recover the port. A subsequent 'no shutdown' is required to bring the interface back up.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
This sequence correctly enables PortFast and BPDU Guard on the interface, then manually recovers the err-disabled port by issuing shutdown followed by no shutdown. PortFast makes the port an edge port, and BPDU Guard disables it if a BPDU is received, preventing future err-disable events.
✗interface g0/3
spanning-tree portfast
spanning-tree bpduguard enable
no shutdownWrong answer — click to see why▾
Why this is wrong here
The err-disabled state requires a manual interface reset (shutdown followed by no shutdown) to recover; a single 'no shutdown' command is insufficient.
Why candidates choose this
Candidates may think that 'no shutdown' alone can recover an err-disabled port, but the port must first be shut down to clear the error condition.
✗interface g0/3
spanning-tree portfast
spanning-tree bpduguard enable
end
copy running-config startup-configWrong answer — click to see why▾
Why this is wrong here
Saving the configuration preserves the settings but does not affect the current operational state of the interface; the port stays err-disabled.
Why candidates choose this
Candidates may confuse configuration tasks with operational recovery, thinking that saving the config will also reset the interface.
✗interface g0/3
spanning-tree portfast
spanning-tree bpduguard enable
shutdownWrong answer — click to see why▾
Why this is wrong here
The shutdown command disables the interface but does not automatically re-enable it; the err-disabled state is cleared only after a shutdown/no shutdown cycle.
Why candidates choose this
Candidates might think that shutting down the interface alone will clear the err-disabled condition, but the port remains administratively down without a 'no shutdown'.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: authentication is not authorization
Logging in proves the user can authenticate. It does not automatically mean the user is allowed to enter privileged or configuration mode. Watch for AAA authorization, privilege level and command authorization details.
Trap categories for this question
Command / output trap
This is incorrect because saving the configuration does not recover the err-disabled port. The port remains in err-disabled state until manually recovered with shutdown/no shutdown. The commands do not include the necessary recovery steps.
Detailed technical explanation
How to think about this question
This kind of question is testing the difference between identity and permission. A user may successfully log in to a router because authentication is working, but still fail to enter configuration mode because authorization is missing, misconfigured or mapped to a lower privilege level.
KKey Concepts to Remember
Authentication checks who the user is.
Authorization controls what the user is allowed to do after login.
Privilege levels affect access to EXEC and configuration commands.
AAA, TACACS+ and RADIUS can separate login success from command access.
TExam Day Tips
→Do not assume successful login means full administrative access.
→Look for words such as cannot enter configuration mode, privilege level, authorization or command access.
→Separate login problems from permission problems before choosing the answer.
Key takeaway
Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.
Real-world example
How this comes up in practice
A practitioner preparing for the 200-301 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review Cisco AAA concepts — authentication, authorization, and accounting. Study privilege levels (0–15), command authorization under TACACS+, and how RADIUS differs. Then practise related 200-301 questions on access control and AAA configuration.
Switching and Network Access — This question tests Switching and Network Access — Authentication checks who the user is..
What is the correct answer to this question?
The correct answer is: interface g0/3
spanning-tree portfast
spanning-tree bpduguard enable
shutdown
no shutdown — The PC connected to SW3's G0/3 was sending BPDUs, causing the port to go err-disabled due to BPDU Guard. To prevent this, enable PortFast and BPDU Guard on that interface. First, move to interface configuration mode for G0/3, then issue 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After configuration, the port will remain err-disabled until manually recovered by issuing 'shutdown' followed by 'no shutdown'. The blocked port on SW2 is G0/2, as shown by the 'Altn BLK' role/status in its spanning-tree output.
What should I do if I get this 200-301 question wrong?
Review Cisco AAA concepts — authentication, authorization, and accounting. Study privilege levels (0–15), command authorization under TACACS+, and how RADIUS differs. Then practise related 200-301 questions on access control and AAA configuration.
What is the key concept behind this question?
Authentication checks who the user is.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.