CCNA Spanning Tree Questions — Page 2 of 2

PBQeasy

You are connected to SW1, a Layer 2 switch. The network administrator wants to prevent unauthorized switches from being connected to access ports. Port G0/1 is an access port in VLAN 10. You need to configure BPDU Guard on this port to protect against STP loops caused by rogue switches. Additionally, enable PortFast for immediate transition to forwarding.

Hints

•PortFast should be applied to access ports to reduce STP convergence time.
•BPDU Guard disables the port if a BPDU is received.
•Both commands are under the interface configuration.

A.SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree bpduguard enable

B.SW1(config)# spanning-tree portfast default SW1(config)# spanning-tree bpduguard default

C.SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree guard root

D.SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree bpduguard disable

AnswerA

solution

! SW1
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Why this answer

PortFast allows an access port to skip STP listening/learning and transition immediately to forwarding. BPDU Guard protects against STP loops by error-disabling the port if a BPDU is received, which would indicate an unauthorized switch connection.

Exam trap

Be careful to distinguish between interface-level and global commands for PortFast and BPDU Guard. Also, remember that BPDU Guard uses 'bpduguard enable' (not 'disable') and is different from Root Guard ('guard root').

Why the other options are wrong

The specific factual error is that global commands affect all ports, not a single interface.

The specific factual error is confusing Root Guard with BPDU Guard; they serve different purposes.

The specific factual error is using the 'disable' keyword instead of 'enable' to activate BPDU Guard.

MCQeasy

Which STP port state on a classic 802.1D switch listens for BPDUs and prepares to participate in the topology, but does not yet learn MAC addresses?

A.Listening

B.Learning

C.Forwarding

D.Disabled

AnswerA

In the classic 802.1D listening state, a port is still blocked from forwarding user data, but it is actively listening to incoming BPDUs to determine the network topology. During this 15-second forward-delay interval, the switch does not learn MAC addresses from the frames it receives, and it cannot send user traffic. Only after this state does the port move to learning.

Why this answer

In classic STP, the listening state processes BPDUs and waits before learning begins. The learning state is when the switch starts populating the MAC table.

Exam trap

Do not confuse the listening state with the learning state; remember that listening involves BPDU processing without MAC address learning.

Why the other options are wrong

In the listening state, a switch port listens for BPDUs but does not learn MAC addresses. The learning state is the next step where the port begins to learn MAC addresses from incoming frames while still not forwarding traffic.

In the Forwarding state, the switch port has already learned MAC addresses and is forwarding data frames, whereas the question specifies a state that does not yet learn MAC addresses.

The Disabled port state does not listen for BPDUs, learn MAC addresses, or forward frames; it is administratively shut down and has no participation in STP topology.

Practice this question →

MCQhard

Refer to the exhibit. An engineer configured PortFast on interface GigabitEthernet0/1, which connects to a server that does not participate in spanning tree. However, the port remains in the listening state for the full forward delay period before transitioning to forwarding. The engineer issues the show spanning-tree vlan 10 detail command. Based on the output, what is the most likely cause?

A.The port is configured as a trunk, so PortFast is not active.

B.BPDU Guard is enabled on the port, causing it to block.

C.The forward delay timer is set too high, and PortFast cannot override it.

D.The server is sending BPDUs, causing the port to lose its PortFast state.

AnswerA

PortFast is only effective on access ports. The exhibit shows ‘Edge port: no (default) portfast: no (default)’ despite the engineer enabling PortFast, indicating the port is operating as a trunk (or not an access port). Therefore, PortFast has no effect and the normal STP listening/learning states apply.

Why this answer

PortFast is designed to immediately transition a port to the forwarding state, bypassing the listening and learning states. However, PortFast is only effective on access ports; if the interface is configured as a trunk port, PortFast is automatically disabled by the switch. The output of 'show spanning-tree vlan 10 detail' would confirm the port is a trunk, explaining why it still goes through the full forward delay.

Exam trap

Cisco often tests the misconception that PortFast works on any port type, but the trap here is that PortFast is only effective on access ports, and trunk ports automatically disable PortFast regardless of configuration.

Why the other options are wrong

The port is not in an err-disabled state; BPDU Guard causes the port to be shut down, not to stay in listening.

Misunderstanding that PortFast bypasses timers completely on access ports; the high forward delay is irrelevant if PortFast were active.

The assumption that the server is sending BPDUs is contradicted by the output showing zero BPDUs received.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port in RSTP.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Configure PortFast and BPDU guard on the access port. Then trigger a violation by connecting an unauthorized switch, which causes the port to error-disable. Diagnose by checking the error-disabled status.

To recover, first remove the offending device, then cycle the port with shutdown and no shutdown; otherwise the port will immediately go error-disabled again.

Exam trap

Do not confuse the order: configuration must precede the violation. Also, recovery requires removing the rogue switch before bouncing the interface; failing to do so will cause the port to trip again.

Practice this question →

MCQeasy

Which STP role identifies the port on a non-root switch that has the best path back to the root bridge?

A.Designated port

B.Root port

C.Alternate port

D.Disabled port

AnswerB

The root port is the single port on a non-root switch that has the lowest root path cost to the root bridge, making it the switch's best path toward the root. It is determined by examining received BPDUs, comparing root path cost, then sender bridge ID, then sender port ID. This port is placed in the forwarding state and is the only port that actively forwards traffic toward the root, ensuring a loop-free topology.

Why this answer

The root port is the single port on a non-root switch that provides the lowest-cost path toward the root bridge. Designated ports forward away from the root for a segment, and alternate ports are backup paths.

Exam trap

A frequent exam trap is mistaking the designated port for the root port. While both forward traffic, the designated port is selected per LAN segment to forward frames away from the root bridge, not necessarily providing the best path back to the root. Another trap is confusing the alternate port with the root port; alternate ports are backup paths kept in blocking state and do not forward traffic unless the root port fails.

Candidates often overlook that the root port is unique per non-root switch and always represents the lowest-cost path to the root bridge, which is the key to answering this question correctly.

Why the other options are wrong

Designated ports are selected for each LAN segment to forward traffic away from the root bridge, but they do not represent the best path back to the root bridge on a non-root switch. Therefore, this option is incorrect.

Alternate ports serve as backup paths and remain in a blocking state unless the root port fails. They do not identify the best path back to the root bridge, so this option is incorrect.

Disabled ports do not participate in STP forwarding or path selection and are not related to identifying the best path back to the root bridge, making this option incorrect.

Practice this question →

PBQhard

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on port GigabitEthernet0/1 (designated port) to protect against superior BPDUs from an unauthorized switch, Loop Guard on uplink GigabitEthernet0/2 to prevent loops, and BPDU Guard on PortFast-enabled GigabitEthernet0/3. After configuration, a superior BPDU arrives on G0/1, blocking the port; verify the Root Guard state and ensure BPDU Guard triggers err-disable on G0/3.

Network Topology

Hints

•Root Guard is applied on ports that should never become root; use 'spanning-tree guard root'.
•Loop Guard prevents alternate or root ports from becoming designated when BPDUs stop; use 'spanning-tree guard loop' on uplinks.
•BPDU Guard combined with PortFast err-disables a port upon BPDU reception; enable with 'spanning-tree bpduguard enable' under the interface.

A.G0/1 is in root-inconsistent state; G0/3 is in err-disabled state.

B.G0/1 is in blocking state; G0/3 is in err-disabled state.

C.G0/1 is in root-inconsistent state; G0/3 is in blocking state.

D.G0/1 is in err-disabled state; G0/3 is in root-inconsistent state.

AnswerA

solution

! R1
interface GigabitEthernet0/1
spanning-tree guard root
interface GigabitEthernet0/2
spanning-tree guard loop
interface GigabitEthernet0/3
spanning-tree bpduguard enable

Why this answer

Root Guard is needed on the designated port (G0/1) to prevent an unauthorized switch from becoming root by sending superior BPDUs. Loop Guard on the uplink (G0/2) prevents loops if BPDUs stop arriving. BPDU Guard on PortFast ports (G0/3) immediately err-disables them upon BPDU reception.

The configuration uses 'spanning-tree guard root' on G0/1, 'spanning-tree guard loop' on G0/2, and 'spanning-tree bpduguard enable' on G0/3. Verification shows G0/1 blocked by root-inconsistent state and G0/3 in err-disabled state.

Exam trap

Do not confuse the states caused by Root Guard (root-inconsistent) and BPDU Guard (err-disable). Also, remember that Root Guard is applied to designated ports, not root or alternate ports.

Why the other options are wrong

Root Guard uses a specific 'root-inconsistent' state, not the generic 'blocking' state.

BPDU Guard triggers err-disable, not blocking. Blocking is an STP state, not an error state.

Root Guard and BPDU Guard have different effects: root-inconsistent vs. err-disable. Mixing them up is a common error.

Practice this question →

MCQhard

A Layer 2 switch port connected to an end host should move to forwarding quickly but also shut down if a BPDU is received. Which pair of features best supports that design?

A.PortFast and BPDU Guard

B.Root Guard and UDLD

C.Loop Guard and native VLAN

D.Port security and EtherChannel

AnswerA

PortFast immediately transitions an access port to the forwarding state, bypassing the listening and learning STP states so the end host can start sending traffic without delay. BPDU Guard protects the STP topology by disabling any PortFast port that receives a BPDU, which indicates an unauthorized switch or bridge has been connected. Together they are the required configuration for a trusted edge port attached to a single end host.

Why this answer

PortFast and BPDU Guard are the right pair. In plain language, PortFast makes an edge port usable quickly for a real end device, while BPDU Guard protects that same port by shutting it down if spanning-tree control traffic appears unexpectedly.

This is a classic access-layer design. PortFast improves usability, and BPDU Guard improves safety. The best answer combines both functions.

Exam trap

Be careful not to confuse BPDU Guard with Root Guard or Loop Guard, as they serve different purposes in spanning tree protection.

Why the other options are wrong

Root Guard and UDLD do not directly address the requirement for a port to quickly transition to forwarding while shutting down upon receiving a BPDU. Root Guard is used to prevent a port from becoming a root port, while UDLD is for detecting unidirectional links.

Loop Guard and native VLAN do not directly address the requirement for a port to quickly transition to forwarding while shutting down upon receiving a BPDU. Loop Guard is designed to prevent loops by keeping a port in a loop-inconsistent state, and native VLAN is related to VLAN tagging, not port state management.

Port security and EtherChannel do not directly address the need for a switch port to quickly transition to forwarding mode while also shutting down upon receiving a BPDU. Port security focuses on limiting MAC addresses and EtherChannel is used for link aggregation, neither of which fulfill the specific requirements of this question.

Practice this question →

MCQmedium

Exhibit: A user reports intermittent connectivity after a new switch was connected to an access port. Which feature would have prevented this by immediately disabling the port when a BPDU was received?

A.Root Guard

B.Loop Guard

C.BPDU Guard

D.UDLD

AnswerC

BPDU Guard is the correct protection mechanism because it is designed specifically for PortFast-enabled access ports. When a legitimate BPDU is received on such a port, BPDU Guard immediately err-disables the interface to prevent a potential bridging loop, which explains the intermittent connectivity: the new device is sending BPDUs and triggering the shutdown each time.

Why this answer

BPDU Guard is the correct answer because it protects PortFast-enabled edge ports by immediately disabling the port upon receiving a BPDU, preventing accidental loops. Root Guard prevents the port from becoming a root port, not from BPDU reception. Loop Guard prevents alternate or root ports from becoming designated due to BPDU loss, unrelated to BPDU reception disabling.

UDLD detects unidirectional links but does not disable ports upon BPDU reception.

Exam trap

Be cautious not to confuse BPDU Guard with other guard features like Root Guard or Loop Guard, which serve different purposes.

Why the other options are wrong

Root Guard prevents a port from being elected as root port, not from receiving BPDUs on an access port.

Loop Guard prevents loops caused by BPDU loss on blocked ports, not from BPDU reception on access ports.

UDLD detects unidirectional links but does not disable a port when a BPDU is received.

Practice this question →