Spanning Tree practice questions

Which TWO switch port configurations are required when connecting a Cisco IP phone and a desktop PC to a single access port?

Trap 1: Configure the port as a trunk and allow both VLANs.

This is incorrect because the port should remain an access port, not a trunk. Trunk ports are used for switch-to-switch or switch-to-router links, not for end devices like phones and PCs.

Trap 2: Disable spanning tree on the port to prevent voice delays.

Disabling spanning tree is dangerous and unnecessary; STP prevents loops and should remain enabled. Voice delays are better managed by QoS and proper VLAN configuration.

Trap 3: Configure the port as a routed port with an IP address for…

Routed ports are used for Layer 3 connectivity between routers or switches, not for connecting end devices like phones and PCs. This would break VLAN segmentation.

A
Configure the port as a trunk and allow both VLANs.
Why wrong: This is incorrect because the port should remain an access port, not a trunk. Trunk ports are used for switch-to-switch or switch-to-router links, not for end devices like phones and PCs.
B
Use the 'switchport voice vlan' command to assign a dedicated voice VLAN.
This command separates voice traffic from data traffic by placing the phone in a specific VLAN, typically VLAN 10 or similar, while the PC remains in the native access VLAN.
C
Disable spanning tree on the port to prevent voice delays.
Why wrong: Disabling spanning tree is dangerous and unnecessary; STP prevents loops and should remain enabled. Voice delays are better managed by QoS and proper VLAN configuration.
D
Apply 'mls qos trust cos' on the interface to preserve voice packet markings.
Cisco IP phones mark voice packets with CoS value 5. Trusting these markings on the access port ensures that the QoS policy in the network treats voice traffic with priority.
E
Configure the port as a routed port with an IP address for management.
Why wrong: Routed ports are used for Layer 3 connectivity between routers or switches, not for connecting end devices like phones and PCs. This would break VLAN segmentation.

Question 2hardmultiple choice

In a network running STP, SW2 became the root bridge for VLAN 10. Both SW1 and SW2 have the same bridge priority. Why did SW2 become the root?

Exhibit

SW1# show spanning-tree vlan 10
VLAN0010
  Root ID    Priority    32778
             Address     0011.2233.4456
  Bridge ID  Priority    32778
             Address     0011.2233.4456

SW2# show spanning-tree vlan 10
VLAN0010
  Root ID    Priority    32778
             Address     0011.2233.4455
  Bridge ID  Priority    32778
             Address     0011.2233.4455

Trap 1: Because SW2 has the higher VLAN number configured.

This is wrong because VLAN number does not decide the root bridge election.

Trap 2: Because SW2 has more trunk ports than SW1.

This is wrong because port count does not determine root bridge election.

Trap 3: Because SW2 has the highest bridge priority.

This is wrong because lower, not higher, bridge ID wins.

A
Because SW2 has the lower bridge ID due to the lower MAC address.
This is correct because the priorities are equal, so the lower MAC address wins the root election.
B
Because SW2 has the higher VLAN number configured.
Why wrong: This is wrong because VLAN number does not decide the root bridge election.
C
Because SW2 has more trunk ports than SW1.
Why wrong: This is wrong because port count does not determine root bridge election.
D
Because SW2 has the highest bridge priority.
Why wrong: This is wrong because lower, not higher, bridge ID wins.

Review the full OSPF breakdown →

Question 3hardmultiple choice

You are verifying OSPF operation on router R1. After confirming that OSPF is configured on the correct interfaces, which command should you use next to directly check whether R1 has established a neighbor adjacency with another OSPF router?

Exhibit

R1#
router ospf 1
 network 10.1.12.0 0.0.0.255 area 0
!
interface GigabitEthernet0/0
 ip address 10.1.12.1 255.255.255.0

Trap 1: show vlan brief

This is wrong because VLAN output does not verify OSPF neighbor state.

Trap 2: show spanning-tree

This is wrong because STP output is not the primary verification tool for OSPF adjacency.

Trap 3: show mac address-table

This is wrong because MAC table output does not verify OSPF neighbor relationships.

A
show ip ospf neighbor
This is correct because it directly shows OSPF adjacency and neighbor state.
B
show vlan brief
Why wrong: This is wrong because VLAN output does not verify OSPF neighbor state.
C
show spanning-tree
Why wrong: This is wrong because STP output is not the primary verification tool for OSPF adjacency.
D
show mac address-table
Why wrong: This is wrong because MAC table output does not verify OSPF neighbor relationships.

Question 4mediummulti select

Which of the following statements about VLAN configuration and trunking on a Cisco switch are correct? (Choose all that apply.)

Question 5easymultiple choice

What problem does Spanning Tree Protocol solve in a switched network?

Trap 1: IP address exhaustion

STP does not address IP address planning.

Trap 2: Slow DNS lookups

DNS performance is unrelated to STP.

Trap 3: Weak wireless encryption

Wireless encryption is unrelated to STP.

A
IP address exhaustion
Why wrong: STP does not address IP address planning.
B
Layer 2 switching loops
Correct. Loop prevention is the core purpose of STP.
C
Slow DNS lookups
Why wrong: DNS performance is unrelated to STP.
D
Weak wireless encryption
Why wrong: Wireless encryption is unrelated to STP.

Question 6hardmultiple choice

A port connected to an end host is configured with PortFast and BPDU Guard. What is the most likely result if a small unmanaged switch is connected and starts sending BPDUs?

Trap 1: The port automatically becomes the root port.

This is wrong because BPDU Guard does not promote the port into STP forwarding roles.

Trap 2: The port is converted into a trunk.

This is wrong because BPDU receipt does not trigger automatic trunk conversion here.

Trap 3: The port ignores the BPDU because PortFast disables STP entirely.

This is wrong because PortFast does not remove BPDU Guard protection.

A
The port is error-disabled by BPDU Guard.
This is correct because BPDU Guard disables an edge port when it receives a BPDU.
B
The port automatically becomes the root port.
Why wrong: This is wrong because BPDU Guard does not promote the port into STP forwarding roles.
C
The port is converted into a trunk.
Why wrong: This is wrong because BPDU receipt does not trigger automatic trunk conversion here.
D
The port ignores the BPDU because PortFast disables STP entirely.
Why wrong: This is wrong because PortFast does not remove BPDU Guard protection.

Question 7hardmultiple choice

Exhibit: Users on SW2 in VLAN 30 can reach local devices but not hosts in VLAN 30 on SW1. What is the most likely reason?

Exhibit

SW1 Gi0/1 trunk allowed vlan 10,20
SW2 Gi0/1 trunk allowed vlan 10,20
Both switches have VLAN 30 configured and access ports assigned correctly.

Trap 1: The trunk native VLAN is 1 on both sides

Distractor.

Trap 2: SW2 must run VTP server mode

Distractor.

Trap 3: Spanning tree blocks all user VLANs by default

Distractor.

A
The trunk native VLAN is 1 on both sides
Why wrong: Distractor.
B
VLAN 30 is not allowed on the trunk
Correct choice.
C
SW2 must run VTP server mode
Why wrong: Distractor.
D
Spanning tree blocks all user VLANs by default
Why wrong: Distractor.

Question 8mediummultiple choice

When spanning tree elects a root bridge, which value is considered first?

Trap 1: Lowest MAC address only

MAC address matters only if the bridge priorities are equal.

Trap 2: Lowest bridge priority only

Priority alone is not the entire comparison value; the full bridge ID is used.

Trap 3: Highest interface bandwidth

Interface bandwidth affects path cost, not root bridge election.

A
Lowest MAC address only
Why wrong: MAC address matters only if the bridge priorities are equal.
B
Lowest bridge priority only
Why wrong: Priority alone is not the entire comparison value; the full bridge ID is used.
C
Lowest bridge ID, which begins with priority
Correct. STP compares the bridge ID, and priority is the leading field in that comparison.
D
Highest interface bandwidth
Why wrong: Interface bandwidth affects path cost, not root bridge election.

Question 9hardmultiple choice

A switch receives BPDUs on a user-facing port configured as an edge port, but instead of just blocking the port role it fully error-disables it. Which protection feature most likely explains that behavior?

Trap 1: Root guard

This is wrong because root guard is more about role/topology protection than this classic err-disable behavior.

Trap 2: Port security

This is wrong because port security focuses on MAC-address learning behavior.

Trap 3: DHCP snooping

This is wrong because DHCP snooping does not error-disable a port for receiving BPDUs.

A
BPDU Guard
This is correct because BPDU Guard typically error-disables an edge port that receives BPDUs.
B
Root guard
Why wrong: This is wrong because root guard is more about role/topology protection than this classic err-disable behavior.
C
Port security
Why wrong: This is wrong because port security focuses on MAC-address learning behavior.
D
DHCP snooping
Why wrong: This is wrong because DHCP snooping does not error-disable a port for receiving BPDUs.

Question 10mediumdrag order

Drag and drop the following steps into the correct order to configure Rapid PVST+ with a designated root bridge, PortFast, and BPDU Guard on access ports.

Question 11mediumdrag order

Drag and drop the following steps into the correct order to configure Rapid PVST+ on SW1, make it the root bridge, and enable PortFast with BPDU Guard on all access ports.

Question 12mediummultiple choice

An engineer wants users to get fast link-up on access ports but also wants the switch to disable a port if another switch is connected and sends BPDUs.

Which combination of features best meets that requirement?

Trap 1: DHCP snooping and DAI

DHCP snooping and Dynamic ARP Inspection are useful security features, but they solve different problems. They help protect address assignment and ARP behavior, not the specific combination of fast access-port startup and protection against a rogue or accidental switch connection.

Trap 2: Root Guard and VTP pruning

Root Guard can help in spanning-tree design, but it is not the standard feature used to give quick edge-port startup. VTP pruning is unrelated to the core requirement. The question is specifically describing the common edge-port hardening pair, which is PortFast with BPDU Guard.

Trap 3: Port security and CDP

Port security controls allowed MAC addresses, and CDP provides device information. Neither pair directly matches the two-part requirement as completely as PortFast and BPDU Guard do.

A
PortFast and BPDU Guard
Correct. This is correct. PortFast provides fast host connectivity, and BPDU Guard protects the port by shutting it down if BPDUs are received from a connected switch.
B
DHCP snooping and DAI
Why wrong: DHCP snooping and Dynamic ARP Inspection are useful security features, but they solve different problems. They help protect address assignment and ARP behavior, not the specific combination of fast access-port startup and protection against a rogue or accidental switch connection.
C
Root Guard and VTP pruning
Why wrong: Root Guard can help in spanning-tree design, but it is not the standard feature used to give quick edge-port startup. VTP pruning is unrelated to the core requirement. The question is specifically describing the common edge-port hardening pair, which is PortFast with BPDU Guard.
D
Port security and CDP
Why wrong: Port security controls allowed MAC addresses, and CDP provides device information. Neither pair directly matches the two-part requirement as completely as PortFast and BPDU Guard do.

Question 13mediumdrag order

Drag and drop the following steps into the correct order to configure a switch port for data and voice traffic.

Question 14mediumdrag order

Drag and drop the following steps into the correct order to configure spanning-tree protection features including BPDU Guard, Root Guard, and Loop Guard on a Cisco switch.

Question 15hardmultiple choice

A security policy requires that only one management subnet be able to initiate SSH to a router. Which approach most directly supports that requirement?

Trap 1: Enable PortFast on the router interfaces.

This is wrong because PortFast is a switch feature, not a router management-access control.

Trap 2: Disable all logging on the router.

This is wrong because disabling logging weakens visibility and does not restrict management access.

Trap 3: Replace SSH with Telnet for easier filtering.

This is wrong because Telnet is less secure than SSH.

A
Use an ACL to permit SSH access only from the approved management subnet.
This is correct because the policy is specifically about restricting management access by source subnet.
B
Enable PortFast on the router interfaces.
Why wrong: This is wrong because PortFast is a switch feature, not a router management-access control.
C
Disable all logging on the router.
Why wrong: This is wrong because disabling logging weakens visibility and does not restrict management access.
D
Replace SSH with Telnet for easier filtering.
Why wrong: This is wrong because Telnet is less secure than SSH.

Question 16hardmultiple choice

An administrator wants to block all Telnet access to a router’s VTY lines and allow only SSH. Which change most directly supports that goal?

Trap 1: Enable PortFast on the VTY lines.

This is wrong because PortFast is a switching feature, not a router management-line control.

Trap 2: Use DHCP snooping to protect the VTY lines.

This is wrong because DHCP snooping is unrelated to router management transport protocols.

Trap 3: Increase the OSPF hello interval.

This is wrong because OSPF timer changes do not secure VTY access.

A
Configure the VTY lines to accept SSH and not Telnet.
This is correct because it directly restricts the management protocol accepted on the router.
B
Enable PortFast on the VTY lines.
Why wrong: This is wrong because PortFast is a switching feature, not a router management-line control.
C
Use DHCP snooping to protect the VTY lines.
Why wrong: This is wrong because DHCP snooping is unrelated to router management transport protocols.
D
Increase the OSPF hello interval.
Why wrong: This is wrong because OSPF timer changes do not secure VTY access.

Question 17hardmultiple choice

A Layer 2 switch port connected to an end host should move to forwarding quickly but also shut down if a BPDU is received. Which pair of features best supports that design?

Trap 1: Root Guard and UDLD

This is wrong because those features do not match the specific edge-port requirement described.

Trap 2: Loop Guard and native VLAN

This is wrong because those settings do not provide the required behavior.

Trap 3: Port security and EtherChannel

This is wrong because EtherChannel is unrelated to the STP edge-port requirement.

A
PortFast and BPDU Guard
This is correct because PortFast speeds edge-port forwarding and BPDU Guard disables the port if a BPDU is received.
B
Root Guard and UDLD
Why wrong: This is wrong because those features do not match the specific edge-port requirement described.
C
Loop Guard and native VLAN
Why wrong: This is wrong because those settings do not provide the required behavior.
D
Port security and EtherChannel
Why wrong: This is wrong because EtherChannel is unrelated to the STP edge-port requirement.

Question 18hardScenario

You are connected to switch SW1. Configure Rapid-PVST+ so that SW1 becomes the root bridge for VLAN 10 and VLAN 20. On interface GigabitEthernet0/2, enable PortFast and BPDUGuard. Then, a BPDU is received on that port, causing err-disable. Diagnose the issue and recover the interface without rebooting the switch.

Exhibit

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    32768
             Address     0011.2233.4455
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32768
             Address     0011.2233.4455
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Desg FWD 4         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p

SW1# show running-config | include bpduguard
spanning-tree portfast bpduguard default

SW1# show interfaces gigabitethernet 0/2
GigabitEthernet0/2 is down, line protocol is down (err-disabled)
  Hardware is Gigabit Ethernet, address is 0011.2233.4456
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex,  Auto-speed
  input flow-control is off, output flow-control is off
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out

SW1# show errdisable recovery
ErrDisable Reason    Timer Status
----------------    --------------
bpduguard           Enabled

SW1# show spanning-tree vlan 20
VLAN0020
  Spanning tree enabled protocol rstp
  Root ID    Priority    32778
             Address     0055.6677.8899
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778
             Address     0055.6677.8899
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Desg FWD 4         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p

Trap 1: Configure SW1 as root for VLAN 10 and 20 using 'spanning-tree vlan…

This is incorrect because 'clear spanning-tree detected-protocols' is used to re-run the STP convergence process, not to recover an err-disabled port. The correct recovery method is either automatic recovery via 'errdisable recovery cause bpduguard' or manual shutdown/no shutdown.

Trap 2: Configure SW1 as root for VLAN 10 and 20 using 'spanning-tree vlan…

This is incorrect because removing BPDUGuard does not recover the err-disabled port; the port remains down until the err-disable condition is cleared. The correct recovery is to use 'errdisable recovery cause bpduguard' or manual shutdown/no shutdown.

Trap 3: Configure SW1 as root for VLAN 10 and 20 using 'spanning-tree vlan…

This is incorrect because reloading the switch is an unnecessary and disruptive method. The err-disabled port can be recovered without rebooting using 'errdisable recovery cause bpduguard' or manual shutdown/no shutdown. Reloading is not a best practice for a single port issue.

A
Configure SW1 as root for VLAN 10 and 20 using 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary'. On Gi0/2, enable PortFast with 'spanning-tree portfast' and BPDUGuard with 'spanning-tree bpduguard enable'. The err-disable state occurs because BPDUGuard shuts down the port when a BPDU is received. To recover, use 'errdisable recovery cause bpduguard' to enable automatic recovery, or manually do 'shutdown' followed by 'no shutdown' on the interface.
This option correctly configures SW1 as root for both VLANs using the 'root primary' command, which sets the bridge priority to 24576. It correctly enables PortFast and BPDUGuard on Gi0/2. The err-disable state is caused by BPDUGuard, and recovery can be automatic via 'errdisable recovery cause bpduguard' or manual by toggling the interface. This matches the standard Cisco troubleshooting process.
B
Configure SW1 as root for VLAN 10 and 20 using 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary'. On Gi0/2, enable PortFast with 'spanning-tree portfast' and BPDUGuard with 'spanning-tree bpduguard enable'. The err-disable state occurs because BPDUGuard shuts down the port when a BPDU is received. To recover, use 'clear spanning-tree detected-protocols' on the interface.
Why wrong: This is incorrect because 'clear spanning-tree detected-protocols' is used to re-run the STP convergence process, not to recover an err-disabled port. The correct recovery method is either automatic recovery via 'errdisable recovery cause bpduguard' or manual shutdown/no shutdown.
C
Configure SW1 as root for VLAN 10 and 20 using 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary'. On Gi0/2, enable PortFast with 'spanning-tree portfast' and BPDUGuard with 'spanning-tree bpduguard enable'. The err-disable state occurs because BPDUGuard shuts down the port when a BPDU is received. To recover, use 'no spanning-tree bpduguard enable' on the interface, then re-enable it.
Why wrong: This is incorrect because removing BPDUGuard does not recover the err-disabled port; the port remains down until the err-disable condition is cleared. The correct recovery is to use 'errdisable recovery cause bpduguard' or manual shutdown/no shutdown.
D
Configure SW1 as root for VLAN 10 and 20 using 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary'. On Gi0/2, enable PortFast with 'spanning-tree portfast' and BPDUGuard with 'spanning-tree bpduguard enable'. The err-disable state occurs because BPDUGuard shuts down the port when a BPDU is received. To recover, use 'reload' on the switch to reset all interfaces.
Why wrong: This is incorrect because reloading the switch is an unnecessary and disruptive method. The err-disabled port can be recovered without rebooting using 'errdisable recovery cause bpduguard' or manual shutdown/no shutdown. Reloading is not a best practice for a single port issue.

Question 19hardScenario

You are connected to a multilayer switch MLS1. Configure Root Guard on the designated port facing another switch SW2 to prevent it from becoming root, configure Loop Guard on the uplink port to the core, and configure BPDU Guard on a PortFast-enabled access port. After configuration, a superior BPDU arrives on the designated port—confirm it is blocked by Root Guard. Then, simulate a BPDU on the access port to verify it goes err-disabled due to BPDU Guard.

Exhibit

MLS1# show spanning-tree

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769
             Address      aabb.cc00.0100
             This bridge is the root

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address      aabb.cc00.0100

  Interface        Role Sts Cost      Prio.Nbr Type
  ------------------- --- --- --------- -------- --------------------------------
  Gi0/0             Desg FWD 4         128.1    P2p
  Gi0/1             Desg FWD 4         128.2    P2p
  Gi0/2             Desg FWD 4         128.3    P2p

Gi0/2 is connected to SW2. Gi0/1 is uplink to core. Gi0/0 is access port with PortFast enabled.

MLS1# show running-config | section interface
interface GigabitEthernet0/0
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet0/1
 switchport mode trunk
!
interface GigabitEthernet0/2
 switchport mode trunk
!

Trap 1: Root Guard on Gi0/1, Loop Guard on Gi0/2, BPDU Guard on Gi0/0

This is incorrect because Root Guard should be applied on the designated port facing SW2 (Gi0/2), not on the uplink to the core (Gi0/1). Loop Guard should be on the uplink, not on the designated port.

Trap 2: Root Guard on Gi0/0, Loop Guard on Gi0/1, BPDU Guard on Gi0/2

This is incorrect because Root Guard should not be on an access port (Gi0/0) as it is PortFast-enabled and not expected to receive BPDUs; BPDU Guard is more appropriate there. BPDU Guard on Gi0/2 would err-disable the designated port upon receiving a superior BPDU, which is not the intended behavior.

Trap 3: Root Guard on Gi0/2, Loop Guard on Gi0/0, BPDU Guard on Gi0/1

This is incorrect because Loop Guard should be on the uplink (Gi0/1), not on the access port (Gi0/0). BPDU Guard should be on the access port, not on the uplink.

A
Root Guard on Gi0/2, Loop Guard on Gi0/1, BPDU Guard on Gi0/0
This configuration correctly applies Root Guard on the designated port (Gi0/2) to block superior BPDUs, Loop Guard on the uplink (Gi0/1) to prevent loops from unidirectional links, and BPDU Guard on the PortFast-enabled access port (Gi0/0) to err-disable upon BPDU reception.
B
Root Guard on Gi0/1, Loop Guard on Gi0/2, BPDU Guard on Gi0/0
Why wrong: This is incorrect because Root Guard should be applied on the designated port facing SW2 (Gi0/2), not on the uplink to the core (Gi0/1). Loop Guard should be on the uplink, not on the designated port.
C
Root Guard on Gi0/0, Loop Guard on Gi0/1, BPDU Guard on Gi0/2
Why wrong: This is incorrect because Root Guard should not be on an access port (Gi0/0) as it is PortFast-enabled and not expected to receive BPDUs; BPDU Guard is more appropriate there. BPDU Guard on Gi0/2 would err-disable the designated port upon receiving a superior BPDU, which is not the intended behavior.
D
Root Guard on Gi0/2, Loop Guard on Gi0/0, BPDU Guard on Gi0/1
Why wrong: This is incorrect because Loop Guard should be on the uplink (Gi0/1), not on the access port (Gi0/0). BPDU Guard should be on the access port, not on the uplink.

Question 20hardmultiple choice

After connecting a new switch to interface GigabitEthernet1/0/1 on a distribution switch, a network engineer notices that the interface is in err-disable state. The engineer checks the configuration and finds that spanning-tree portfast and spanning-tree bpduguard enable are applied to the interface. What is the most likely cause of the err-disable state?

Trap 1: BPDU Guard was incorrectly enabled on a port that should be a trunk…

BPDU Guard can be enabled on any port, not just access ports. The err-disable occurred because BPDU Guard received a BPDU while PortFast was enabled on an inter-switch link. If the port were a trunk without PortFast, BPDU Guard would not be triggered unless globally forced, but the question states both features were present. The port being an access or trunk does not directly cause the err-disable.

Trap 2: The connected switch is sending BPDUs with a lower bridge priority.

BPDU Guard triggers on any BPDU, regardless of bridge priority or root bridge election. A lower priority simply influences STP topology; it does not cause an err-disable condition. The trigger is the receipt of a BPDU, not its contents.

Trap 3: The port is configured as an access port, but should be a trunk.

An access/trunk mismatch would cause VLAN-related problems, but it would not lead to an err-disable triggered by BPDU Guard. Switches still send BPDUs on access ports by default, so the BPDU Guard reaction is independent of the port mode. The issue here is PortFast, not the switchport mode.

A
BPDU Guard was incorrectly enabled on a port that should be a trunk link.
Why wrong: BPDU Guard can be enabled on any port, not just access ports. The err-disable occurred because BPDU Guard received a BPDU while PortFast was enabled on an inter-switch link. If the port were a trunk without PortFast, BPDU Guard would not be triggered unless globally forced, but the question states both features were present. The port being an access or trunk does not directly cause the err-disable.
B
The connected switch is sending BPDUs with a lower bridge priority.
Why wrong: BPDU Guard triggers on any BPDU, regardless of bridge priority or root bridge election. A lower priority simply influences STP topology; it does not cause an err-disable condition. The trigger is the receipt of a BPDU, not its contents.
C
Spanning-tree PortFast is enabled on a port that connects to another switch.
PortFast skips the listening and learning STP states and is designed for end hosts. When combined with BPDU Guard, the switch was instructed to disable the port upon receiving any BPDU. The downstream switch naturally sends BPDUs, causing BPDU Guard to react and place the port in err-disable. Removing PortFast (and leaving BPDU Guard alone, or disabling BPDU Guard on that link) would resolve the issue.
D
The port is configured as an access port, but should be a trunk.
Why wrong: An access/trunk mismatch would cause VLAN-related problems, but it would not lead to an err-disable triggered by BPDU Guard. Switches still send BPDUs on access ports by default, so the BPDU Guard reaction is independent of the port mode. The issue here is PortFast, not the switchport mode.