How many Spanning Tree Protocol Scenarios questions are on this page?

This page has 15 Spanning Tree Protocol Scenarios scenario questions for the 200-301 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-301 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to CCNA 200-301 v2 questions

Scenario-based practice

Spanning Tree Protocol Scenarios

Practise 200-301 STP questions covering root bridge election, bridge IDs, port roles (root, designated, blocking), path cost, PortFast, BPDU Guard, and how spanning tree prevents Layer 2 loops.

Start full practice test Read exam guide

scenario questions

200-301

exam code

Cisco

vendor

Scenario guide

How to approach spanning tree protocol scenarios

STP and Rapid PVST+ questions test your understanding of root bridge election, port roles, port states, and protection features. These appear in MCQ, multi-select, and drag-and-drop formats on the CCNA because STP behaviour is non-intuitive and frequently misunderstood.

Quick answer

STP questions usually test root bridge election, port roles, path cost and how spanning tree prevents Layer 2 loops.

Root bridge election and bridge ID comparison.

Root ports, designated ports and blocked/alternate ports.

Path cost and how switches choose the best path to the root bridge.

PortFast, BPDU Guard and common Layer 2 loop-prevention behaviour.

Practice scenarios

Question 1hardmultiple choice

Full question →

A network administrator notices that a switchport in access mode with PortFast enabled has transitioned to an err-disabled state. What is the most likely cause?

Exhibit

interface GigabitEthernet1/0/9
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable

Event:
%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on PortFast enabled port. Disabling interface.

A
BPDU Guard disabled the PortFast-enabled access port after it received a BPDU.
This is correct because the event message explicitly identifies a BPDU Guard violation.
B
Port security shut down the port because the VLAN was wrong.
Why wrong: This is wrong because the event shown is about BPDUs, not MAC-based port security.
C
DHCP snooping disabled the interface because a host requested an address.
Why wrong: This is wrong because DHCP snooping does not produce this spanning-tree error.
D
EtherChannel suspended the interface because the bundle was incomplete.
Why wrong: This is wrong because the event message points to BPDU Guard, not EtherChannel.

Full breakdown with real-world context →

Question 2hardmultiple choice

Open the full VLAN trunking answer →

In a network running STP, SW2 became the root bridge for VLAN 10. Both SW1 and SW2 have the same bridge priority. Why did SW2 become the root?

Exhibit

SW1# show spanning-tree vlan 10
VLAN0010
  Root ID    Priority    32778
             Address     0011.2233.4456
  Bridge ID  Priority    32778
             Address     0011.2233.4456

SW2# show spanning-tree vlan 10
VLAN0010
  Root ID    Priority    32778
             Address     0011.2233.4455
  Bridge ID  Priority    32778
             Address     0011.2233.4455

A
Because SW2 has the lower bridge ID due to the lower MAC address.
This is correct because the priorities are equal, so the lower MAC address wins the root election.
B
Because SW2 has the higher VLAN number configured.
Why wrong: This is wrong because VLAN number does not decide the root bridge election.
C
Because SW2 has more trunk ports than SW1.
Why wrong: This is wrong because port count does not determine root bridge election.
D
Because SW2 has the highest bridge priority.
Why wrong: This is wrong because lower, not higher, bridge ID wins.

Full breakdown with real-world context →

Question 3mediummulti select

Full question →

Which TWO of the following statements accurately describe the configuration and behavior of Root Guard, Loop Guard, and BPDU Guard in Rapid PVST+ environments?

A
Root Guard, when enabled on a port, prevents that port from becoming the root port by placing it in a root-inconsistent state if a superior BPDU is received.
Root Guard ensures the designated port does not become a root port. Upon receiving a superior BPDU, the port enters a root-inconsistent state, blocking traffic until the superior BPDUs stop.
B
Root Guard automatically shuts down the port when a superior BPDU is received, similar to BPDU Guard.
Why wrong: Root Guard does not shut down the port; it places the port in a root-inconsistent state, which effectively blocks traffic but does not disable the port. BPDU Guard, on the other hand, errdisables the port.
C
Loop Guard, when enabled, disables a port if BPDUs are no longer received on it, preventing a unidirectional link failure.
Why wrong: Loop Guard does not disable the port; it places the port into a loop-inconsistent state, blocking traffic on that port until BPDUs are received again. The port remains administratively up.
D
BPDU Guard, when enabled, puts the port in an errdisable state if a BPDU is received, which is typically used on access ports to prevent unauthorized switches from connecting.
BPDU Guard is designed to protect against rogue switches. If any BPDU arrives on a port with BPDU Guard, the port is immediately errdisabled, requiring manual or automatic recovery.
E
BPDU Guard places the port in a blocking state (loop-inconsistent) when a BPDU is received, similar to Loop Guard.
Why wrong: BPDU Guard errdisables the port, not just blocks it. Loop Guard uses a loop-inconsistent state, which is different from errdisable. BPDU Guard is a more severe reaction.

Full breakdown with real-world context →

Question 4easymultiple choice

Open the full STP breakdown →

What problem does Spanning Tree Protocol solve in a switched network?

A
IP address exhaustion
Why wrong: STP does not address IP address planning.
B
Layer 2 switching loops
Correct. Loop prevention is the core purpose of STP.
C
Slow DNS lookups
Why wrong: DNS performance is unrelated to STP.
D
Weak wireless encryption
Why wrong: Wireless encryption is unrelated to STP.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

A port connected to an end host is configured with PortFast and BPDU Guard. What is the most likely result if a small unmanaged switch is connected and starts sending BPDUs?

A
The port is error-disabled by BPDU Guard.
This is correct because BPDU Guard disables an edge port when it receives a BPDU.
B
The port automatically becomes the root port.
Why wrong: This is wrong because BPDU Guard does not promote the port into STP forwarding roles.
C
The port is converted into a trunk.
Why wrong: This is wrong because BPDU receipt does not trigger automatic trunk conversion here.
D
The port ignores the BPDU because PortFast disables STP entirely.
Why wrong: This is wrong because PortFast does not remove BPDU Guard protection.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

A network engineer notices that a new switch, SW3, was connected to port GigabitEthernet0/1 on SW1, but the port immediately went into an err-disabled state. The network uses Rapid PVST+ with BPDU Guard enabled globally on all access ports. The engineer checks the logs and sees 'bpduguard error detected' messages. What is the most likely cause of the err-disabled state?

Exhibit

SW1# show interfaces gigabitEthernet 0/1 status

Port      Name   Status       Vlan       Duplex  Speed Type
Gi0/1            err-disabled 1          auto    auto  10/100/1000BaseTX

SW1# show running-config interface gigabitEthernet 0/1
Building configuration...

Current configuration : 109 bytes
!
interface GigabitEthernet0/1
 switchport mode access
 spanning-tree bpduguard enable
end

SW1# show spanning-tree interface gigabitEthernet 0/1 detail
 Port 1 (GigabitEthernet0/1) of VLAN0001 is broken (BPDU Guard)
   Port path cost 4, Port priority 128, Port Identifier 128.1.
   Designated root has priority 32768, address aaaa.bbbb.cccc
   Designated bridge has priority 32768, address aaaa.bbbb.cccc
   Designated port id is 128.1, designated path cost 0
   Timers: message age 0, forward delay 0, hold 0
   BPDU: sent 0, received 3

A
The port is configured as an access port, but BPDU Guard should be disabled on all access ports.
Why wrong: BPDU Guard is typically enabled on access ports to prevent rogue switches; disabling it globally would reduce security.
B
A BPDU was received on port GigabitEthernet0/1, triggering BPDU Guard.
BPDU Guard err-disables a port immediately when a BPDU is received on an access port where it is enabled, which is exactly the scenario described.
C
Configure Root Guard on the interface to prevent the err-disabled state.
Why wrong: Root Guard prevents a port from becoming a root port, but it does not prevent err-disabled; it causes a root-inconsistent state.
D
Enable Loop Guard on the interface to prevent the err-disabled state.
Why wrong: Loop Guard prevents alternate or root ports from becoming designated when BPDUs are lost, but it does not prevent err-disabled from BPDU Guard.

Full breakdown with real-world context →

Question 7mediummultiple choice

Full question →

Why is BPDU Guard commonly enabled on PortFast-enabled access ports?

A
To make STP root election happen faster
Why wrong: BPDU Guard is a protection feature, not a speed optimization for root election.
B
To disable STP permanently on access ports
Why wrong: STP is not permanently disabled.
C
To err-disable a port if it receives unexpected BPDUs
That is the core purpose of BPDU Guard.
D
To allow only one MAC address on the access port
Why wrong: That would be port security.

Full breakdown with real-world context →

Question 8mediummultiple choice

Open the full STP breakdown →

When spanning tree elects a root bridge, which value is considered first?

A
Lowest MAC address only
Why wrong: MAC address matters only if the bridge priorities are equal.
B
Lowest bridge priority only
Why wrong: Priority alone is not the entire comparison value; the full bridge ID is used.
C
Lowest bridge ID, which begins with priority
Correct. STP compares the bridge ID, and priority is the leading field in that comparison.
D
Highest interface bandwidth
Why wrong: Interface bandwidth affects path cost, not root bridge election.

Full breakdown with real-world context →

Question 9mediumdrag order

Full question →

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port in RSTP.

A
Configure PortFast and BPDU guard on the interface.
This is the first step: enabling PortFast and BPDU guard on the access port to prevent loops and protect against rogue BPDUs.
B
Trigger a BPDU guard violation by connecting a switch to the port.
This is incorrect because the violation must be triggered after configuration, but it is not the first step; configuration comes first.
C
Diagnose the violation by checking the error-disabled status.
This is incorrect because diagnosis occurs after the violation, not before configuration.
D
Remove the unauthorized switch, then recover the port by issuing the 'shutdown' and 'no shutdown' commands.
This is incorrect because recovery is the final step, not the first.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

A switch receives BPDUs on a user-facing port configured as an edge port, but instead of just blocking the port role it fully error-disables it. Which protection feature most likely explains that behavior?

A
BPDU Guard
This is correct because BPDU Guard typically error-disables an edge port that receives BPDUs.
B
Root guard
Why wrong: This is wrong because root guard is more about role/topology protection than this classic err-disable behavior.
C
Port security
Why wrong: This is wrong because port security focuses on MAC-address learning behavior.
D
DHCP snooping
Why wrong: This is wrong because DHCP snooping does not error-disable a port for receiving BPDUs.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full NAT/PAT explanation →

Exhibit: SW2 receives superior BPDUs on both uplinks. One uplink becomes the root port and the other becomes alternate. Which factor is considered first when SW2 chooses the root port?

Exhibit

SW2 uplink A root path cost = 4
SW2 uplink B root path cost = 19
Both links receive superior BPDUs

A
Lowest local interface MAC address
Why wrong: MAC address is not the first deciding factor for root port selection.
B
Lowest root path cost
That is the first major comparison.
C
Highest duplex setting
Why wrong: Duplex is not a root port tie-breaker.
D
Lowest configured VLAN number
Why wrong: VLAN number is not used to choose a root port.

Full breakdown with real-world context →

Question 12easymultiple choice

Open the full STP breakdown →

Which STP port state on a classic 802.1D switch listens for BPDUs and prepares to participate in the topology, but does not yet learn MAC addresses?

A
Listening
Listening comes before learning and does not yet learn MACs.
B
Learning
Why wrong: Learning does begin populating the MAC table.
C
Forwarding
Why wrong: Forwarding sends user traffic.
D
Disabled
Why wrong: Disabled does not participate in STP.

Full breakdown with real-world context →

Question 13mediumdrag order

Read the full NAT/PAT explanation →

Drag and drop the following steps into the correct order to configure Rapid PVST+ with a designated root bridge, PortFast, and BPDU Guard on access ports.

Question 14mediumdrag order

Full question →

Drag and drop the following steps into the correct order to configure Rapid PVST+ on SW1, make it the root bridge, and enable PortFast with BPDU Guard on all access ports.

Question 15mediummultiple choice

Read the full NAT/PAT explanation →

An engineer wants users to get fast link-up on access ports but also wants the switch to disable a port if another switch is connected and sends BPDUs.

Which combination of features best meets that requirement?

A
PortFast and BPDU Guard
Correct. This is correct. PortFast provides fast host connectivity, and BPDU Guard protects the port by shutting it down if BPDUs are received from a connected switch.
B
DHCP snooping and DAI
Why wrong: DHCP snooping and Dynamic ARP Inspection are useful security features, but they solve different problems. They help protect address assignment and ARP behavior, not the specific combination of fast access-port startup and protection against a rogue or accidental switch connection.
C
Root Guard and VTP pruning
Why wrong: Root Guard can help in spanning-tree design, but it is not the standard feature used to give quick edge-port startup. VTP pruning is unrelated to the core requirement. The question is specifically describing the common edge-port hardening pair, which is PortFast with BPDU Guard.
D
Port security and CDP
Why wrong: Port security controls allowed MAC addresses, and CDP provides device information. Neither pair directly matches the two-part requirement as completely as PortFast and BPDU Guard do.

Full breakdown with real-world context →

These 200-301 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 200-301 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Spanning Tree Protocol Scenarios

How to approach spanning tree protocol scenarios

Quick answer

Related 200-301 topic practice pages

Network Infrastructure and Connectivity practice questions

Switching and Network Access practice questions

IP Routing practice questions

Network Services and Security practice questions

AI and Network Operations practice questions

CCNA subnetting practice questions

CCNA OSPF practice questions

CCNA VLAN practice questions

CCNA STP practice questions

CCNA EtherChannel practice questions

CCNA ACL practice questions

CCNA NAT practice questions

Practice scenarios

A network administrator notices that a switchport in access mode with PortFast enabled has transitioned to an err-disabled state. What is the most likely cause?

Exhibit

In a network running STP, SW2 became the root bridge for VLAN 10. Both SW1 and SW2 have the same bridge priority. Why did SW2 become the root?

Exhibit

Which TWO of the following statements accurately describe the configuration and behavior of Root Guard, Loop Guard, and BPDU Guard in Rapid PVST+ environments?

What problem does Spanning Tree Protocol solve in a switched network?

A port connected to an end host is configured with PortFast and BPDU Guard. What is the most likely result if a small unmanaged switch is connected and starts sending BPDUs?

Exhibit

Why is BPDU Guard commonly enabled on PortFast-enabled access ports?

When spanning tree elects a root bridge, which value is considered first?

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port in RSTP.

A switch receives BPDUs on a user-facing port configured as an edge port, but instead of just blocking the port role it fully error-disables it. Which protection feature most likely explains that behavior?

Exhibit: SW2 receives superior BPDUs on both uplinks. One uplink becomes the root port and the other becomes alternate. Which factor is considered first when SW2 chooses the root port?

Exhibit

Which STP port state on a classic 802.1D switch listens for BPDUs and prepares to participate in the topology, but does not yet learn MAC addresses?

Drag and drop the following steps into the correct order to configure Rapid PVST+ with a designated root bridge, PortFast, and BPDU Guard on access ports.

Drag and drop the following steps into the correct order to configure Rapid PVST+ on SW1, make it the root bridge, and enable PortFast with BPDU Guard on all access ports.