N10-009 Network Security Practice Question
A security auditor discovers that an unauthorized switch has been connected to an access port in the wiring closet. The rogue switch caused a network loop and disrupted connectivity. Which security feature, if enabled on the access port, would have prevented this by disabling the port when a BPDU is received?
⚠ Common exam trap
CompTIA often tests the distinction between BPDU guard and Root guard, where candidates mistakenly choose Root guard thinking it prevents loops, but Root guard only protects the root bridge election and does not disable a port upon BPDU reception.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BPDU guard
BPDU guard is the correct answer because it is specifically designed to protect against rogue switch connections on access ports. When enabled, if a port receives any Bridge Protocol Data Unit (BPDU), it immediately places the port into an errdisable state, effectively disabling it and preventing a potential network loop. This directly addresses the scenario where an unauthorized switch connected to an access port caused a loop.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
BPDU guard
Why this is correct
BPDU guard is a critical Spanning Tree Protocol (STP) security feature designed to protect the integrity of the STP domain by preventing unauthorized devices from influencing the network topology. When enabled on an access port, it immediately places the port into an error-disabled state upon receiving any Bridge Protocol Data Unit (BPDU). This action effectively shuts down the port, isolating the unauthorized switch and preventing it from injecting BPDUs that could disrupt the STP topology or create network loops.
- ✗
Root guard
Why it's wrong here
Root guard is an STP enhancement that ensures the designated root bridge remains in its intended location within the network topology. If a port configured with root guard receives superior BPDUs that would cause it to become the root port (implying a connected switch is attempting to become the root bridge), the port is placed into a root-inconsistent state, effectively blocking traffic. However, it does not disable the port or prevent the reception of BPDUs from an unauthorized switch; it merely prevents that switch from influencing the root bridge election.
When this WOULD be correct
Root guard would be correct in a scenario where an administrator wants to ensure that a specific switch remains the root bridge and prevent any other switch from becoming root by sending superior BPDUs. For example, on a port connected to a customer switch, root guard would disable the port if a superior BPDU is received.
- ✗
Loop guard
Why it's wrong here
Loop guard is an STP feature designed to prevent Layer 2 loops that can occur when a port configured as an STP alternate or backup port stops receiving BPDUs from its designated bridge. In such a scenario, the port might erroneously transition to a forwarding state, creating a loop. Loop guard places the port into a loop-inconsistent state until BPDUs are again received, but it does not react to the *reception* of BPDUs from an unauthorized device, only to their *absence*.
When this WOULD be correct
A question describing a scenario where a unidirectional link failure causes a loop, and the solution must prevent a port from transitioning to forwarding state when BPDUs stop arriving (e.g., due to a faulty cable).
- ✗
UDLD
Why it's wrong here
Unidirectional Link Detection (UDLD) is a Layer 2 protocol that monitors the physical configuration of a link to detect if it is operating unidirectionally, meaning data can flow in only one direction. This typically occurs due to cabling errors or faulty hardware. UDLD sends periodic messages to verify bidirectional communication; if a link becomes unidirectional, UDLD can shut down the port to prevent issues like blackholing traffic. However, UDLD does not interact with Spanning Tree Protocol BPDUs or address the threat of unauthorized switches injecting BPDUs into the network.
When this WOULD be correct
UDLD would be correct in a scenario where a network administrator needs to detect and disable ports that are only transmitting in one direction, preventing issues like routing loops or STP failures due to unidirectional links.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓BPDU guardCorrect answer▾
Why this is correct
BPDU guard is a critical Spanning Tree Protocol (STP) security feature designed to protect the integrity of the STP domain by preventing unauthorized devices from influencing the network topology. When enabled on an access port, it immediately places the port into an error-disabled state upon receiving any Bridge Protocol Data Unit (BPDU). This action effectively shuts down the port, isolating the unauthorized switch and preventing it from injecting BPDUs that could disrupt the STP topology or create network loops.
✗Root guardWrong answer — click to see why▾
Why this is wrong here
Root guard is used to enforce the root bridge position in a spanning-tree topology, not to disable ports upon receiving BPDUs. It does not prevent unauthorized switches from causing loops by disabling the port.
★ When this WOULD be the correct answer
Root guard would be correct in a scenario where an administrator wants to ensure that a specific switch remains the root bridge and prevent any other switch from becoming root by sending superior BPDUs. For example, on a port connected to a customer switch, root guard would disable the port if a superior BPDU is received.
Why candidates choose this
Candidates may confuse root guard with BPDU guard because both involve BPDUs and port disabling, but root guard focuses on maintaining root bridge status rather than preventing unauthorized switches.
✗Loop guardWrong answer — click to see why▾
Why this is wrong here
Loop guard is designed to prevent alternate or root ports from becoming designated ports in the absence of BPDUs, not to disable a port upon receiving a BPDU. It does not protect against rogue switches sending BPDUs.
★ When this WOULD be the correct answer
A question describing a scenario where a unidirectional link failure causes a loop, and the solution must prevent a port from transitioning to forwarding state when BPDUs stop arriving (e.g., due to a faulty cable).
Why candidates choose this
Candidates may confuse loop guard with BPDU guard because both deal with loops and BPDUs, but loop guard addresses missing BPDUs rather than unexpected BPDUs.
✗UDLDWrong answer — click to see why▾
Why this is wrong here
UDLD (Unidirectional Link Detection) detects unidirectional links but does not disable a port upon receiving BPDUs; it is not designed to prevent rogue switches or loops caused by BPDU reception.
★ When this WOULD be the correct answer
UDLD would be correct in a scenario where a network administrator needs to detect and disable ports that are only transmitting in one direction, preventing issues like routing loops or STP failures due to unidirectional links.
Why candidates choose this
Candidates may confuse UDLD with BPDU guard because both involve loop prevention, but UDLD focuses on unidirectional links rather than unauthorized BPDU reception.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
BPDU Guard
BPDU Guard is a Cisco switch feature that protects the network from unauthorized devices by disabling a port if it receives a Bridge Protocol Data Unit (BPDU).
Key term
BPDU
A Bridge Protocol Data Unit is a layer 2 frame that switches use to exchange information about the Spanning Tree Protocol (STP) to prevent network loops.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.