CCNA Network Services and Security Practice Question
A user reports that their desk port stopped working immediately after they connected a small switch. The interface shows err-disabled, and the log mentions BPDU Guard. What most likely happened?
⚠ Common exam trap
A frequent exam trap is mistaking BPDU Guard triggers for issues caused by DHCP snooping or port security. Candidates may incorrectly assume that DHCP snooping blocking ARP or port security violations cause the err-disabled state when the log explicitly mentions BPDU Guard. Another pitfall is confusing native VLAN mismatches on trunks as the cause, but these do not generate BPDU Guard errors. The key is to recognize that BPDU Guard specifically responds to receiving BPDUs on PortFast-enabled ports, which signals an unexpected switch connection and leads to err-disable. Misreading the log or symptoms can lead to selecting incorrect answers that do not align with BPDU Guard’s function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The port received a BPDU and BPDU Guard shut it down.
BPDU Guard is commonly enabled on PortFast access ports to protect the topology. If the port receives a BPDU, the switch assumes another switch may have been connected and places the port into err-disabled state. That is exactly the protective behavior you want at the edge.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The port received a BPDU and BPDU Guard shut it down.
Why this is correct
BPDU Guard on a PortFast-enabled edge port immediately err-disables the interface upon receiving any BPDU, typically from an unauthorized switch. This matches the symptom of a desk port stopping right after connection, and the log would explicitly show 'bpduguard error detected' putting the port in err-disable state.
- ✗
DHCP snooping blocked the user's ARP requests.
Why it's wrong here
DHCP snooping is a Layer 2 security feature that filters DHCP messages and can rate-limit or block DHCP offers, but it does not filter ARP requests. ARP filtering would be a function of Dynamic ARP Inspection (DAI) or port security; therefore, DHCP snooping alone would not produce a BPDU Guard err-disable event or shut down the port.
When this WOULD be correct
In a scenario where a user connects a device that sends DHCP requests and the switch is configured with DHCP snooping, a question could ask about the impact of DHCP snooping on ARP requests. If the switch detects invalid ARP requests from a rogue device, it could block those requests, making this option correct.
- ✗
Port security moved the port to protect mode.
Why it's wrong here
Port security in protect mode (or restrict mode) drops offending traffic and may generate a log or SNMP trap, but it does not place the interface into an err-disabled state. Only violation mode 'shutdown' err-disables the port, and the log would mention a port-security violation, not BPDU Guard. The question explicitly states the log points to BPDU Guard, confirming this option is incorrect.
When this WOULD be correct
If the question described a scenario where a switch port was configured with port security and a device connected had a MAC address not previously seen, resulting in a violation, then port security could indeed place the port in protect mode. This would be a valid context for option C to be correct.
- ✗
The trunk native VLAN matched incorrectly.
Why it's wrong here
A native VLAN mismatch on a trunk can cause spanning-tree and Layer 2 connectivity issues, but it typically generates CDP error messages and might cause BPDU inconsistencies only in specific scenarios. It does not directly trigger BPDU Guard, which is a PortFast feature that reacts to any BPDU reception on an access port, not to VLAN configuration mismatches.
When this WOULD be correct
In a different question setup, if a user reports that a trunk port is not passing traffic and the logs indicate a native VLAN mismatch, then this option would be correct. The question would need to focus on trunk configurations and VLAN settings to validate this scenario.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The port received a BPDU and BPDU Guard shut it down.Correct answer▾
Why this is correct
BPDU Guard on a PortFast-enabled edge port immediately err-disables the interface upon receiving any BPDU, typically from an unauthorized switch. This matches the symptom of a desk port stopping right after connection, and the log would explicitly show 'bpduguard error detected' putting the port in err-disable state.
✗DHCP snooping blocked the user's ARP requests.Wrong answer — click to see why▾
Why this is wrong here
DHCP snooping is a security feature that filters DHCP messages and can block ARP requests only if Dynamic ARP Inspection (DAI) is also configured. It does not cause an err-disable state or generate a BPDU Guard log message. The log explicitly mentions BPDU Guard, not DHCP snooping.
★ When this WOULD be the correct answer
In a scenario where a user connects a device that sends DHCP requests and the switch is configured with DHCP snooping, a question could ask about the impact of DHCP snooping on ARP requests. If the switch detects invalid ARP requests from a rogue device, it could block those requests, making this option correct.
Why candidates choose this
Students might confuse DHCP snooping with BPDU Guard because both are security features that can block traffic. However, DHCP snooping operates at Layer 2/3 for DHCP messages, while BPDU Guard specifically handles BPDUs and err-disables the port.
✗Port security moved the port to protect mode.Wrong answer — click to see why▾
Why this is wrong here
Port security can place a port in protect mode, which drops traffic from unauthorized MAC addresses but does not err-disable the port. The log message mentions BPDU Guard, not port security. Additionally, port security protect mode does not generate a BPDU Guard log entry.
★ When this WOULD be the correct answer
If the question described a scenario where a switch port was configured with port security and a device connected had a MAC address not previously seen, resulting in a violation, then port security could indeed place the port in protect mode. This would be a valid context for option C to be correct.
Why candidates choose this
Port security and BPDU Guard are both common access port security features. A student might think that connecting a switch triggers port security due to multiple MAC addresses, but the log explicitly points to BPDU Guard, making this incorrect.
✗The trunk native VLAN matched incorrectly.Wrong answer — click to see why▾
Why this is wrong here
A native VLAN mismatch on a trunk can cause connectivity issues but does not directly trigger BPDU Guard on an access port. BPDU Guard is configured on access ports, not trunks, and the log message specifically indicates BPDU Guard, not a native VLAN mismatch.
★ When this WOULD be the correct answer
In a different question setup, if a user reports that a trunk port is not passing traffic and the logs indicate a native VLAN mismatch, then this option would be correct. The question would need to focus on trunk configurations and VLAN settings to validate this scenario.
Why candidates choose this
Students might associate VLAN mismatches with spanning-tree issues, but BPDU Guard is a separate mechanism. The scenario describes a desk port (access port) and a small switch, which is more likely to trigger BPDU Guard than a native VLAN mismatch.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Bridge Protocol Data Unit
A Bridge Protocol Data Unit (BPDU) is a special message that network switches exchange to detect and prevent loops in an Ethernet network.
Key term
BPDU Guard
BPDU Guard is a Cisco switch feature that protects the network from unauthorized devices by disabling a port if it receives a Bridge Protocol Data Unit (BPDU).
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.