easyMultiple Choice
350-401 Practice Question: Is troubleshooting a connectivity issue in a…
A network engineer is troubleshooting a connectivity issue in a switched network. The network uses Rapid PVST+ with multiple VLANs. The engineer notices that a host connected to an access port on SW1 cannot communicate with the default gateway, which is on a distribution switch. The access port is configured with PortFast and BPDU Guard. The engineer checks the switch logs and sees that the port went into errdisable state. What is the most likely cause of the errdisable state?
⚠ Common exam trap
Cisco often tests the distinction between BPDU Guard (which reacts to BPDUs) and other errdisable causes like loop guard, UDLD, or link-flap; the trap here is assuming that any errdisable on an access port must be due to a physical issue (duplex, cable) rather than a deliberate STP protection mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Another switch was connected to the access port, causing BPDU Guard to disable the port.
The access port is configured with PortFast and BPDU Guard. PortFast immediately transitions the port to forwarding, but BPDU Guard monitors for incoming BPDUs. When another switch is connected to this access port, it sends BPDUs, triggering BPDU Guard to error-disable the port to prevent a potential bridging loop. This matches the log entry showing the port went into errdisable state. Note that BPDU Guard is specifically designed to protect against unauthorized switches, and Root Guard is a separate mechanism used on uplinks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Another switch was connected to the access port, causing BPDU Guard to disable the port.
Why this is correct
When an access port is configured with PortFast, it assumes only an end host is attached, and BPDU Guard is often enabled to protect the STP domain. If another switch connects and sends a BPDU, BPDU Guard immediately places the port in errdisable state, which matches the log's reference to BPDU Guard. This is the only option that explains why the port was disabled and why the log specifically cites BPDU Guard.
- ✗
A broadcast storm occurred due to a loop in the network.
Why it's wrong here
A broadcast storm is a network-wide symptom caused by a bridging loop, and it would manifest as high CPU utilization, MAC address flapping, and saturated links. However, the log explicitly states that BPDU Guard disabled the port, and BPDU Guard triggers only when a BPDU is received on a PortFast-enabled port—not in response to broadcast traffic. While a loop could generate BPDUs, the disabling action is directly attributed to BPDU Guard, not to a storm.
- ✗
The host connected to the port caused a duplex mismatch.
Why it's wrong here
A duplex mismatch between a host and the switch would produce late collisions, CRC errors, and a high error counter on the interface, but it does not cause the switch to invoke BPDU Guard. BPDU Guard is an STP feature that errdisables a PortFast port only upon receiving a BPDU, which a normal host would not send. The log references BPDU Guard directly, making a duplex mismatch an unrelated condition that would generate different log messages about link errors.
- ✗
The cable connecting the host is faulty, causing link flaps.
Why it's wrong here
A faulty cable would cause the link to flap—rapid transitions between up and down—and the switch's link-flap detection could eventually place the port in errdisable state, but that would be logged as a link-flap event, not a BPDU Guard event. BPDU Guard specifically reacts to Layer 2 STP BPDUs, which are not introduced by cabling problems. Since the log explicitly mentions BPDU Guard, a faulty cable is not the cause; it would not cause another switch's BPDU to appear on that port.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.