Cisco Certified Network Associate (CCNA) 200-301 Practice Test 23
Question 220
A redundant switch port that is currently an alternate (non-designated) Rapid PVST+ path stops receiving BPDUs because of a one-way fault. Engineers must prevent it from incorrectly moving into forwarding state while the fault persists. Which feature fits?
- BPDU Guard applied to a user-facing PortFast edge port
- Root Guard applied where an access switch must never advertise a superior root
- PortFast applied to the redundant interswitch alternate port
- Loop Guard on the non-designated redundant link
Explanation
Correct Answer
D:Loop Guard observes non-designated STP ports that are supposed to receive BPDUs. If the BPDUs stop, it can hold the port in a loop-inconsistent blocked condition rather than allowing it to become designated and forward into a physical loop. When BPDUs resume, recovery is automatic. This directly matches an alternate/root-port unidirectional or missing-BPDU event. Confirm the port's STP role with `show spanning-tree`, check for loop-inconsistent state and investigate the physical or protocol fault. Root Guard, by contrast, is intended for superior BPDUs received on designated ports. Loop Guard cannot rescue links that were already unidirectional before a normal BPDU relationship ever existed, so physical diagnostics still matter.
Incorrect Answers
A:BPDU Guard is designed to protect edge-facing ports by reacting when a BPDU is unexpectedly received, commonly errdisabling the port. The issue here is the opposite: an alternate network link stops receiving the expected BPDUs, risking a false assumption of a loop-free path. BPDU Guard does not provide the required loss-of-BPDU protection for this non-designated interswitch role.
B:Root Guard prevents a designated port from accepting a superior-BPDU root change and can place it in root-inconsistent state. It is not the correct mechanism for an alternate or root port that stops receiving BPDUs. Cisco documents the roles as different: Root Guard protects the intended root hierarchy, whereas Loop Guard protects non-designated paths from transitioning incorrectly when expected BPDUs vanish. They should not be interchanged on the same port.
C:PortFast speeds the transition of genuine edge ports to forwarding and is not appropriate on a redundant interswitch alternate path. Applying it here could bypass the normal participation safeguards that prevent Layer 2 loops. The root problem is missing expected control-plane BPDUs, not a legitimate host-facing device needing faster access initialization. Changing PortFast settings would aggravate the risk.
Question 221
Troubleshooting report: An access switch unexpectedly becomes root after its priority was configured lower than the intended distribution-root switch. Which finding best accounts for the behavior?
- The access switch became root because its CPU has fewer interfaces, independent of bridge IDs.
- An access switch was configured with a lower STP bridge priority/BID than the intended distribution root, so it won root election.
- The intended distribution switch always wins because its uplinks are faster, regardless of configured bridge priority.
- A VLAN mismatch in the workstation DNS settings elected the access switch as root.
Explanation
Correct Answer
B:STP picks the lowest bridge ID, not the most capable distribution device. Restore an appropriately lower priority on the intended root and ensure the access switch cannot preempt it unexpectedly.
Incorrect Answers
A:Hardware size and interface count are not root election criteria.
C:Bandwidth affects port-cost paths but does not override a lower root BID.
D:DNS has no effect on STP Bridge-ID comparison or BPDU election.
Question 222
A faster physical interface is not the root port because its overall advertised root-path cost is larger than the alternative. The team should investigate which specific technical cause?
- A faster local physical port must win root-port election regardless of upstream BPDU cost.
- The port with the highest interface number wins root-port election before any path-cost comparison.
- OSPF DR priority on the interface determines its STP root-port role.
- The candidate interface has a greater total STP root path cost than the selected path; cumulative cost outranks raw local PHY speed.
Explanation
Correct Answer
D:STP root-port election evaluates the received advertised cost plus the ingress port cost. A nominally fast link behind a costly upstream route can lose to a slower local port with a better root path.
Incorrect Answers
A:STP chooses the lowest total cost to the root, not highest local Ethernet speed alone.
B:Sender bridge/port identifiers break certain ties only after superior root and path-cost fields are compared.
C:OSPF DR election is a routed broadcast-segment function unrelated to STP port roles.
Question 223
A switching team must explain an outage. Both sides of a redundant loop show forwarding without an alternate/blocking role, and broadcasts circulate continuously. Which diagnosis follows from these observations?
- There is an uncontrolled Layer 2 forwarding loop because redundant bridge paths lack an effective STP blocking/alternate role.
- The redundant ports are correctly configured as alternate/discarding paths while the broadcast storm continues only due to normal STP behavior.
- A healthy default IP route prevents repeated Ethernet broadcast circulation in a switched loop.
- The physical ports must be half-duplex because an STP loop is impossible on full-duplex switched Ethernet.
Explanation
Correct Answer
A:A bridged cycle with all relevant redundant ports forwarding can repeatedly flood broadcasts and unknown unicasts, consuming bandwidth and destabilizing the MAC table. Restore working spanning-tree protection.
Incorrect Answers
B:An alternate discarding path would break the cycle; the evidence instead shows excessive redundant forwarding.
C:IP routing tables do not stop L2 broadcast replication within a looped VLAN.
D:Modern full-duplex Ethernet can still form Layer 2 bridging loops without STP containment.
Question 224
A switching team collects this evidence: A redundant alternate port remains discarding even though its cable is healthy; no failure occurred because another path forwards. Which root-cause interpretation best fits the observations?
- Every healthy physical redundant cable must forward at the same time to avoid wasted bandwidth.
- A discarding alternate always proves a failed NIC or administratively shut interface.
- An OSPF adjacency mismatch is the necessary cause of an RSTP alternate state.
- The port is the RSTP alternate and properly remains discarding because a superior path to the root is already forwarding.
Explanation
Correct Answer
D:A healthy backup link need not forward concurrently. In RSTP, an alternate port provides standby reachability and may rapidly become active if the current root path fails.
Incorrect Answers
A:STP intentionally leaves some healthy redundant paths discarding to prevent bridging loops.
B:The role/state can be an expected control-plane decision while carrier remains good.
C:STP assigns L2 port roles using BPDUs and path costs independent of OSPF.
Question 225
Troubleshooting report: A PC takes excessive time to receive DHCP after link-up because its user-facing port waits in ordinary spanning-tree transition. Which finding best accounts for the behavior?
- The root bridge must be replaced every time a PC DHCP exchange starts late.
- DHCP DISCOVER frames are always transported by OSPF and require a new dynamic routing adjacency.
- The port is correctly configured as PortFast edge and forwards immediately; the observed delay proves the switchport has no link state.
- The workstation-facing interface lacks appropriate edge/PortFast behavior and waits for STP state transitions before delivering DHCP frames.
Explanation
Correct Answer
D:Host-facing ports can use PortFast when they connect only to end devices, reducing delays at link-up. The diagnosis does not require modifying the overall root bridge or blocking redundant uplinks.
Incorrect Answers
A:A single edge port transition delay can be solved locally while preserving a healthy root topology.
B:Local DHCP broadcast forwarding is Layer 2 within the VLAN and is not an OSPF adjacency issue.
C:The given symptom is ordinary STP convergence rather than confirmed immediate PortFast forwarding.
Question 226
Gi1/0/12 is an access switchport with PortFast and BPDU Guard enabled for a user workstation. A user connects a small unmanaged switch that sends a spanning-tree BPDU, and Gi1/0/12 immediately becomes errdisabled. What explains the shutdown?
- Root Guard permanently rewrote the bridge priority and shut down the entire switch.
- BPDU Guard detected a BPDU on a protected edge port and placed the interface into an error-disabled state as configured.
- An EtherChannel LACP mismatch prevented the workstation from authenticating.
- The IPv4 access list's implicit deny caused the Ethernet line protocol to change to errdisabled.
Explanation
Correct Answer
B:BPDU Guard is intended to protect user-facing PortFast edge ports from unexpected participation in spanning-tree topology. When a BPDU arrives on an edge interface with BPDU Guard active, the switch can place that port into errdisabled state, limiting the risk of an unauthorized switch affecting the topology. Inspect the errdisable reason, interface state, portfast/BPDU Guard configuration and event logs. Remove or correct the BPDU-producing downstream device and recover the interface according to the approved operational procedure. Simply clearing the errdisable condition without removing the cause will allow the shutdown to recur.
Incorrect Answers
A:Root Guard prevents a downstream device from becoming an unexpected spanning-tree root by responding to superior BPDUs, ordinarily with a root-inconsistent blocking state. It is different from BPDU Guard errdisabling a PortFast edge port after any unexpected BPDU. The observed errdisabled cause matches BPDU Guard, not a switchwide rewrite of bridge priority.
C:LACP bundles Ethernet member links into an EtherChannel and does not by itself determine whether a single edge workstation port enters a BPDU Guard errdisable condition. The user connected a BPDU-speaking downstream switch, which triggers the explicitly configured edge protection. No aggregation negotiation is required to explain the event.
D:An IPv4 ACL evaluates Layer 3/4 traffic and can permit or deny packets, but it does not typically create a switchport errdisabled event when a spanning-tree BPDU arrives. BPDUs are Layer 2 control frames, and BPDU Guard handles them at the edge. Read the switch's errdisable reason before modifying IP filtering.
Question 227
A distribution switch uses Root Guard on Gi1/0/22 toward an access switch. After the access switch is misconfigured with a superior bridge ID, the distribution port enters root-inconsistent state, but the link remains electrically up. Which mechanism best explains this behavior?
- BPDU Guard always discards only the individual BPDU and leaves the port forwarding.
- Loop Guard enables forwarding automatically whenever received BPDUs claim a better root.
- Root Guard refuses to accept a superior BPDU from the downstream access switch and blocks that port until the superiority condition is removed.
- Port security restrict mode removes all legitimate learned MAC addresses and disables the switch's trunk database.
Explanation
Correct Answer
C:Root Guard is placed where the local switch must not accept a new root bridge from an unintended direction. Receiving a superior BPDU on a guarded port causes a root-inconsistent blocking condition rather than permitting the neighbor to redefine the spanning-tree root. The port can remain physically connected, because the protection targets spanning-tree control-plane topology, not carrier. Inspect `show spanning-tree inconsistentports`, the current bridge IDs and which device sent the superior BPDU. Correct the access-switch priority or unwanted switch connection; normal forwarding can resume after the superior-BPDU condition clears. It does not require arbitrarily changing the core root.
Incorrect Answers
A:BPDU Guard on a protected edge interface can errdisable the port when any BPDU appears. It does not merely drop a single offending BPDU while leaving forwarding untouched. Here the recorded root-inconsistent condition and superior BPDU are characteristic of Root Guard, which operates differently from BPDU Guard.
B:Loop Guard is designed to prevent a nondesignated port from erroneously transitioning to forwarding when expected spanning-tree BPDUs cease arriving, such as during a one-way link failure. It is not the feature whose signature event is a superior BPDU entering a downstream Root Guard boundary.
D:Port security restrict mode drops frames with unauthorized source MAC addresses and increments violations without necessarily shutting the interface. It is unrelated to electing a spanning-tree root or creating root-inconsistent state after superior BPDUs. The correct evidence is spanning-tree status and bridge identifiers, not MAC violation counters.
Question 228
A switching team collects this evidence: A backup port stops receiving BPDUs without losing physical carrier and is held loop-inconsistent rather than erroneously forwarding. Which root-cause interpretation best fits the observations?
- The port is blocked by BPDU Guard because it received an unexpected BPDU from a user.
- An absent BPDU stream always forces immediate forwarding to preserve maximum active links.
- The interface must have lost electrical carrier because it is loop-inconsistent.
- Loop Guard holds the non-designated port in loop-inconsistent state when expected BPDUs stop, rather than letting it incorrectly become designated forwarding.
Explanation
Correct Answer
D:On suitable non-designated links, Loop Guard protects against unidirectional or missing-BPDU conditions without physical link-down. After BPDUs resume, eligible ports may recover from loop-inconsistent.
Incorrect Answers
A:BPDU Guard responds to BPDU receipt on an edge port; Loop Guard responds to missing expected BPDUs on protected non-designated links.
B:That would risk an L2 loop; Loop Guard deliberately prevents unsafe role promotion.
C:The scenario explicitly states carrier stays up; the condition is a control-plane protection state.
Question 229
The earlier fault was recorded as follows: An access switch unexpectedly becomes root after its priority was configured lower than the intended distribution-root switch. After corrective work, which observation provides direct evidence that the affected function now behaves correctly?
- The access switch continues advertising itself as root with the lowest BID, but its access port LEDs are green.
- A DNS lookup to the distribution switch succeeds while STP root BID remains the access switch.
- `show spanning-tree vlan <id> root` and detailed STP output identify the intended distribution bridge as the VLAN root and show access switches’ non-root roles.
- Only an arbitrary VLAN other than the affected VLAN reports the distribution root.
Explanation
Correct Answer
C:A corrected root-priority configuration should be visible in the winning root BID and learned port roles. Merely assigning a priority without checking election is not enough.
Incorrect Answers
A:The root election fault persists despite normal physical link state.
B:IP name resolution does not establish that the intended device won STP election.
D:Rapid PVST+ elects per-VLAN root; validation must include the affected VLAN.
Question 230
A switching team has repaired a network problem. A faster physical interface is not the root port because its overall advertised root-path cost is larger than the alternative. Which device or protocol check is the strongest evidence that this particular failure is gone?
- Compare only the Ethernet speed labels and assume the faster member is root port without reading path costs.
- Check the root bridge priority only, ignoring which local port actually wins root-port selection.
- `show spanning-tree vlan <id> detail` reports the selected root port and total root path costs, matching the intended least-cost path and documented tie-breakers.
- Verify `show ip route` has a gateway of last resort while the STP root port remains incorrect.
Explanation
Correct Answer
C:The repair concerns path selection, so compare received BPDU root costs plus local port costs on all candidates. PHY speed alone is not a decisive acceptance test.
Incorrect Answers
A:An upstream cost difference may outweigh the local speed contribution.
B:Root election and non-root bridge port selection are related but distinct STP decisions.
D:Layer 3 route presence does not validate Layer 2 path-cost election.
