JN0-106 Networking Fundamentals Practice Question
An engineer enables Spanning Tree PortFast on a switch port connected to a host. Later, another switch is connected to that same port, causing a loop. What feature could have prevented this?
⚠ Common exam trap
Watch out — candidates often confuse BPDU guard with Loop guard, thinking both prevent loops, but Loop guard addresses unidirectional link failures, not the accidental connection of a switch to a PortFast port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BPDU guard
BPDU guard is the correct answer because it disables a port configured with PortFast if a BPDU is received, preventing loops when a switch is accidentally connected. In this scenario, PortFast was enabled for a host, but connecting another switch caused BPDUs to be sent, which BPDU guard detects and shuts down the port to break the loop.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Loop guard
Why it's wrong here
Loop guard is a protection mechanism for non-designated ports, such as alternate or root ports, that prevents them from entering the forwarding state when BPDUs stop arriving—typically due to a unidirectional link failure. It does not proactively shut down a port that receives an unexpected BPDU; instead, it places the port into an inconsistent state if BPDUs cease. On a PortFast edge port, loop guard is not appropriate because PortFast assumes no other bridge is attached, and loop guard does nothing to stop the initial reception of a BPDU from a rogue switch. Therefore, while loop guard addresses certain failure scenarios, it does not fulfill the rapid BPDU-triggered shutdown that is needed here.
- ✓
BPDU guard
Why this is correct
BPDU guard is the correct companion feature for PortFast because PortFast places a port into the forwarding state immediately, assuming it connects only to an end host. If the port receives any Spanning Tree Protocol BPDU—indicating that a switch or bridge has been connected—BPDU guard immediately error-disables the port, stopping all traffic and preventing a potential bridging loop. This proactive shutdown is far faster than allowing the spanning tree algorithm to recalculate and block the port. By disabling the port on the very first BPDU, BPDU guard enforces the edge-port assumption and provides strong protection against accidental misconfigurations or malicious devices.
- ✗
Root guard
Why it's wrong here
Root guard is designed to enforce the root bridge placement by preventing a designated port from becoming a root port. When a port configured with root guard receives a superior BPDU—one that advertises a lower bridge ID or path cost—it transitions the port to a root-inconsistent state rather than allowing the port to be selected as the root port. This does not cause the port to be disabled merely for receiving any BPDU; only superior BPDUs trigger the reaction, and the port continues to forward normal traffic before that event. On a PortFast access port, an end host would never send a superior BPDU, so root guard would not provide the expected protection against a connected switch. Hence, root guard solves a different problem and is not interchangeable with BPDU guard.
- ✗
UplinkFast
Why it's wrong here
UplinkFast is a Cisco proprietary feature that accelerates convergence after an uplink failure on a switch by immediately promoting an alternate port to forwarding and sending multicast frames to update CAM tables. It operates on root and alternate ports, not on edge ports, and relies on the underlying spanning tree state rather than monitoring for unexpected BPDUs. Enabling UplinkFast alongside PortFast would not shut down a port that receives a BPDU; it only speeds up recovery after a link fails. Therefore, UplinkFast is unrelated to the security concern of an unauthorized switch being connected to a PortFast port, making it an incorrect answer here.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 156 original JN0-106 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This JN0-106 practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JN0-106 exam.