CCNP Practice Question: Interface GigabitEthernet0/3 spanning-tree guard…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The port will error-disable if it receives a BPDU that would cause the switch to become a non-root bridge.

  Why this is correct

  Root Guard is a protection mechanism enabled on designated ports of a switch that should remain the root bridge. If such a port receives a BPDU from another switch that advertises a lower bridge ID or better root path cost, that BPDU is 'superior' and would normally cause the local switch to surrender root status. Rather than accept it, Root Guard places the port into a root-inconsistent (blocking) state — often referred to as error-disabling the port — so the intended root remains authoritative. The port does not pass traffic until the invalid BPDUs stop and the STP topology stabilizes.

• ✗

  The port will block all BPDUs received from other switches.

  Why it's wrong here

  Root Guard is not a BPDU filter; it does not discard or block incoming BPDUs. A Root Guard-enabled port still sends and receives normal STP BPDUs, and the switch uses those BPDUs during ordinary convergence as long as they do not advertise a superior root. Preventing all BPDUs from other switches would make STP completely deaf to topology changes, which is instead the purpose of BPDU Filter, not Root Guard.

• ✗

  The port will become the root port for the VLAN.

  Why it's wrong here

  A port running Root Guard has no authority to assign itself the root port role; STP elects root ports based on the lowest root path cost from each bridge. Root Guard only imposes a constraint on designated ports, and if a superior BPDU arrives on that port, the switch does not use it as a new root-port path — it disables the port to protect the current root. Thus, rather than becoming the root port, the interface is taken out of the active topology.

• ✗

  The port will ignore BPDUs from switches with lower bridge ID.

  Why it's wrong here

  The term 'ignore' is misleading: Root Guard actively examines every received BPDU and specifically looks for a lower bridge ID, because that is the condition that threatens the root bridge. When such a BPDU is received, the port is not silently ignoring the peer; instead, the switch raises the port to root-inconsistent state and blocks traffic. Ignoring the BPDU would allow the STP process to keep operating normally, whereas Root Guard's entire purpose is to react to the intrusion by disrupting that port's operation.