The answer is to configure Loop Guard on GigabitEthernet1/0/1 and 1/0/2 using the interface-level command spanning-tree guard loop, then recover the err-disabled port G1/0/5 with a shutdown followed by no shutdown. This is correct because Root Guard on G1/0/3 is already functioning as intended—blocking a superior BPDU to protect the root bridge role—and BPDU Guard on PortFast-enabled interfaces like G1/0/5 is expected to err-disable the port upon receiving any BPDU from an unauthorized host. The missing piece is Loop Guard, which prevents alternate or root ports from transitioning into the forwarding state if BPDUs stop arriving, a common failure scenario on unidirectional links. On the CCNA 200-301 v2 exam, this question tests your ability to distinguish between these three STP protection features and apply them at the correct interface level; a common trap is confusing Loop Guard with Root Guard or forgetting that BPDU Guard only works on PortFast ports. Memory tip: Root Guard blocks superior BPDUs, Loop Guard blocks missing BPDUs, and BPDU Guard blocks any BPDU on an access port.
CCNA Switching and Network Access Practice Question
This 200-301 practice question tests your understanding of switching and network access. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
R1#show running-config | section interface
interface GigabitEthernet1/0/1
description Uplink to Core
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/2
description Uplink to Core
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/3
description Potential Root Port
switchport access vlan 10
switchport mode access
spanning-tree guard root
!
interface GigabitEthernet1/0/4
description Server
switchport access vlan 10
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet1/0/5
description Desktop
switchport access vlan 10
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface Vlan10
ip address 192.168.10.1 255.255.255.0
!
R1#show spanning-tree vlan 10
VLAN0010
Spanning tree enabled protocol ieee
Root ID Priority 4097
Address 0011.2233.4455
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 4097 (priority 4096 sys-id-ext 1)
Address 0011.2233.4455
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi1/0/1 Desg FWD 4 128.1 Shr
Gi1/0/2 Desg FWD 4 128.2 Shr
Gi1/0/3 Desg BKN*4 128.3 Shr *ROOT_Guard
Gi1/0/4 Desg FWD 4 128.4 Shr Edge
Gi1/0/5 Desg FWD 4 128.5 Shr Edge
R1#show interfaces status | include err-disabled
Gi1/0/5 err-disabled auto auto 10/100/1000
You are securing the spanning-tree topology on R1, the root bridge for VLAN 10. Intended configurations: Root Guard on GigabitEthernet1/0/3, Loop Guard on gigabit interfaces 1/0/1 and 1/0/2, and BPDU Guard on all PortFast-enabled interfaces. After initial configuration, a superior BPDU on G1/0/3 blocks the port (expected), and a host on G1/0/5 triggers BPDU Guard, causing err-disable (expected). However, you realize Loop Guard was not applied to the uplinks. Troubleshoot and apply the missing configuration.
R1#show running-config | section interface
interface GigabitEthernet1/0/1
description Uplink to Core
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/2
description Uplink to Core
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/3
description Potential Root Port
switchport access vlan 10
switchport mode access
spanning-tree guard root
!
interface GigabitEthernet1/0/4
description Server
switchport access vlan 10
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet1/0/5
description Desktop
switchport access vlan 10
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface Vlan10
ip address 192.168.10.1 255.255.255.0
!
R1#show spanning-tree vlan 10
VLAN0010
Spanning tree enabled protocol ieee
Root ID Priority 4097
Address 0011.2233.4455
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 4097 (priority 4096 sys-id-ext 1)
Address 0011.2233.4455
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi1/0/1 Desg FWD 4 128.1 Shr
Gi1/0/2 Desg FWD 4 128.2 Shr
Gi1/0/3 Desg BKN*4 128.3 Shr *ROOT_Guard
Gi1/0/4 Desg FWD 4 128.4 Shr Edge
Gi1/0/5 Desg FWD 4 128.5 Shr Edge
R1#show interfaces status | include err-disabled
Gi1/0/5 err-disabled auto auto 10/100/1000
A
Remove Root Guard from G1/0/3 and configure it with 'spanning-tree guard loop' to prevent the blockage.
Why wrong: This is incorrect because Root Guard is functioning correctly; the blockage is intentional to protect the root bridge. Removing Root Guard would leave the root bridge vulnerable.
B
Re-enable G1/0/5 with 'no shutdown' and apply 'spanning-tree bpduguard enable' on all PortFast-enabled interfaces to prevent future err-disable.
Why wrong: This is incorrect because BPDU Guard is already enabled on PortFast interfaces (as per the task), and the err-disable occurred because a host sent a BPDU. Re-enabling the port is necessary, but BPDU Guard should remain; the issue is that the host should not be sending BPDUs.
C
Configure Loop Guard on G1/0/1 and G1/0/2 with 'spanning-tree guard loop' and recover G1/0/5 from err-disable by issuing 'shutdown' followed by 'no shutdown'.
This is correct because Loop Guard is missing on the uplinks, which is required by the task. Additionally, G1/0/5 is in err-disable state due to BPDU Guard; it must be re-enabled with 'no shutdown'. Root Guard on G1/0/3 is correct and should remain.
D
Remove BPDU Guard from all PortFast interfaces and configure 'spanning-tree portfast bpdufilter default' to prevent err-disable.
Why wrong: This is incorrect because BPDU Filter would suppress BPDUs, which could lead to loops. The task requires BPDU Guard to be applied, and the err-disable is a protective measure. Removing BPDU Guard or using BPDU Filter is not the correct resolution.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Loop Guard on G1/0/1 and G1/0/2 with 'spanning-tree guard loop' and recover G1/0/5 from err-disable by issuing 'shutdown' followed by 'no shutdown'.
The candidate must first identify that Root Guard is correctly configured on G1/0/3, causing it to block (BKN*ROOT_Guard) upon receiving a superior BPDU, which is correct behavior. However, the task states to protect the root bridge role; since R1 is already root, Root Guard is appropriate. The err-disabled port G1/0/5 indicates BPDU Guard triggered; this is expected because a host connected to a PortFast port sent a BPDU. To resolve, the candidate should re-enable the port with 'no shutdown' and ensure BPDU Guard is properly applied. Additionally, Loop Guard is missing on uplinks G1/0/1 and G1/0/2; it must be configured with 'spanning-tree guard loop' under each interface. No changes to Root Guard are needed; the blockage is intentional.
Key principle: A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Remove Root Guard from G1/0/3 and configure it with 'spanning-tree guard loop' to prevent the blockage.
Why it's wrong here
This is incorrect because Root Guard is functioning correctly; the blockage is intentional to protect the root bridge. Removing Root Guard would leave the root bridge vulnerable.
✗
Re-enable G1/0/5 with 'no shutdown' and apply 'spanning-tree bpduguard enable' on all PortFast-enabled interfaces to prevent future err-disable.
Why it's wrong here
This is incorrect because BPDU Guard is already enabled on PortFast interfaces (as per the task), and the err-disable occurred because a host sent a BPDU. Re-enabling the port is necessary, but BPDU Guard should remain; the issue is that the host should not be sending BPDUs.
✓
Configure Loop Guard on G1/0/1 and G1/0/2 with 'spanning-tree guard loop' and recover G1/0/5 from err-disable by issuing 'shutdown' followed by 'no shutdown'.
Why this is correct
This is correct because Loop Guard is missing on the uplinks, which is required by the task. Additionally, G1/0/5 is in err-disable state due to BPDU Guard; it must be re-enabled with 'no shutdown'. Root Guard on G1/0/3 is correct and should remain.
Related concept
Access ports place end devices into a single VLAN.
✗
Remove BPDU Guard from all PortFast interfaces and configure 'spanning-tree portfast bpdufilter default' to prevent err-disable.
Why it's wrong here
This is incorrect because BPDU Filter would suppress BPDUs, which could lead to loops. The task requires BPDU Guard to be applied, and the err-disable is a protective measure. Removing BPDU Guard or using BPDU Filter is not the correct resolution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure Loop Guard on G1/0/1 and G1/0/2 with 'spanning-tree guard loop' and recover G1/0/5 from err-disable by issuing 'shutdown' followed by 'no shutdown'.Correct answer▾
Why this is correct
This is correct because Loop Guard is missing on the uplinks, which is required by the task. Additionally, G1/0/5 is in err-disable state due to BPDU Guard; it must be re-enabled with 'no shutdown'. Root Guard on G1/0/3 is correct and should remain.
✗Remove Root Guard from G1/0/3 and configure it with 'spanning-tree guard loop' to prevent the blockage.Wrong answer — click to see why▾
Why this is wrong here
Root Guard is designed to block a port that receives superior BPDUs, which is exactly what happened. The configuration is correct and should not be removed.
Why candidates choose this
Candidates may think that any blocked port is a problem and needs to be fixed by changing the guard type, not realizing that Root Guard's purpose is to block in this scenario.
✗Re-enable G1/0/5 with 'no shutdown' and apply 'spanning-tree bpduguard enable' on all PortFast-enabled interfaces to prevent future err-disable.Wrong answer — click to see why▾
Why this is wrong here
BPDU Guard is correctly configured; the err-disable is expected behavior when a BPDU is received on a PortFast port. The solution is to re-enable the port and ensure the host is not a switch.
Why candidates choose this
Candidates might think that BPDU Guard should be removed or that the configuration is missing, but it is already applied and working as designed.
✗Remove BPDU Guard from all PortFast interfaces and configure 'spanning-tree portfast bpdufilter default' to prevent err-disable.Wrong answer — click to see why▾
Why this is wrong here
BPDU Filter is not a substitute for BPDU Guard; it prevents the port from sending or receiving BPDUs, which can cause bridging loops. The correct action is to re-enable the port, not change the protection mechanism.
Why candidates choose this
Candidates may confuse BPDU Guard with BPDU Filter, thinking that filtering BPDUs would prevent the err-disable, but this compromises network stability.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: an active trunk can still block the VLAN you need
A trunk being up does not prove every VLAN is crossing it. Check allowed VLAN lists, native VLAN mismatch, VLAN existence and access-port assignment.
Detailed technical explanation
How to think about this question
VLAN questions usually combine access-port and trunking clues. The key is to identify whether the issue is local to one switchport, caused by the trunk, or caused by the VLAN not existing where it needs to exist.
KKey Concepts to Remember
Access ports place end devices into a single VLAN.
Trunk ports carry multiple VLANs between switches.
Allowed VLAN lists decide which VLANs can cross a trunk.
Native VLAN mismatch can create confusing symptoms.
TExam Day Tips
→Use show vlan brief to verify access VLANs.
→Use show interfaces trunk to verify trunk state and allowed VLANs.
→Do not treat every same-VLAN issue as a routing problem.
Key takeaway
A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related 200-301 questions on switching, trunking, and access-port configuration.
Switching and Network Access — This question tests Switching and Network Access — Access ports place end devices into a single VLAN..
What is the correct answer to this question?
The correct answer is: Configure Loop Guard on G1/0/1 and G1/0/2 with 'spanning-tree guard loop' and recover G1/0/5 from err-disable by issuing 'shutdown' followed by 'no shutdown'. — The candidate must first identify that Root Guard is correctly configured on G1/0/3, causing it to block (BKN*ROOT_Guard) upon receiving a superior BPDU, which is correct behavior. However, the task states to protect the root bridge role; since R1 is already root, Root Guard is appropriate. The err-disabled port G1/0/5 indicates BPDU Guard triggered; this is expected because a host connected to a PortFast port sent a BPDU. To resolve, the candidate should re-enable the port with 'no shutdown' and ensure BPDU Guard is properly applied. Additionally, Loop Guard is missing on uplinks G1/0/1 and G1/0/2; it must be configured with 'spanning-tree guard loop' under each interface. No changes to Root Guard are needed; the blockage is intentional.
What should I do if I get this 200-301 question wrong?
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related 200-301 questions on switching, trunking, and access-port configuration.
What is the key concept behind this question?
Access ports place end devices into a single VLAN.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.