Preventing Layer 2 Loops in Campus Topology
Short answer
AE Engineer must include loop guard on uplink and root guard on downlink to prevent Layer 2 loops.
Question
Refer to the exhibit. Which two technologies must an engineer include in the design to prevent Layer 2 loops in this topology? (Choose two.)
Key Takeaways
Root Guard prevents unauthorized root bridges, while Loop Guard protects against unidirectional link failures; they serve complementary roles in different directions of the link.
Learn how to prevent Layer 2 loops in Cisco campus networks using loop guard on uplinks and root guard on downlinks. This guide explains the correct configuration for the 300-420 exam.
Common mistake: Choosing BPDU Guard. BPDU Guard shuts down ports receiving BPDUs and is meant for edge/user ports, not inter-switch links like uplinks or downlinks, which require normal BPDU exchange.
Expert Analysis
The exhibit depicts a standard enterprise campus topology with a distribution layer switch acting as the root bridge for its downstream access layer switches. The question asks for two technologies to prevent Layer 2 loops.
Why Root Guard on Downlink (E) is Correct: Access switches connect to distribution switches via uplinks. If an access switch were to accidentally become the root bridge (e.g., due to misconfiguration or lower priority), it could disrupt the spanning tree design. Placing Root Guard on the distribution switch's ports facing the access switches (downlinks) ensures that if an access switch tries to advertise itself as the root, those ports are put into a root-inconsistent state. This prevents the access switch from becoming the root without shutting down the port entirely, thus maintaining the designed loop-free topology.
Why Loop Guard on Uplink (A) is Correct: Uplinks from access switches to distribution switches are critical paths. If these links fail to receive BPDUs (due to unidirectional link failure or congestion), STP might incorrectly calculate the topology and transition ports to forwarding, causing loops. Loop Guard works by monitoring BPDUs on non-designated ports. If BPDUs stop arriving, Loop Guard places the port in a loop-inconsistent state (blocking it). Enabling Loop Guard on the access switch's uplink ports protects against this scenario, ensuring that the path to the root remains stable even if BPDUs are lost.
Why Other Options Are Incorrect:
- BPDU Guard (B, C): BPDU Guard is designed for PortFast/Edge ports where no BPDUs should ever be seen. It shuts down the port upon receiving a BPDU. Applying it to uplinks (C) would cause flapping if legitimate BPDUs are sent. Applying it to downlinks (B) is generally inappropriate because downlinks connect to other switches that do send BPDUs; doing so would block valid STP traffic. While some designs use BPDU Guard on user-facing ports, the question focuses on inter-switch links (uplinks/downlinks) for loop prevention.
- Root Guard on Uplink (D): Root Guard is typically placed on ports where you do not want the connected device to become the root. On an access switch's uplink, the goal is usually to ensure the upstream device remains root. However, Root Guard does not protect against unidirectional link failures (the primary cause of loops when BPDUs are lost); Loop Guard does. Furthermore, placing Root Guard on the uplink doesn't address the risk of the access switch becoming root as effectively as placing it on the distribution side (Option E).
The combination of Loop Guard on Uplinks (to protect against BPDU loss on the path to root) and Root Guard on Downlinks (to prevent unauthorized root changes from downstream devices) provides robust Layer 2 loop prevention in this hierarchy.
Exam Strategy
When designing STP protection, always match the tool to the threat. Use Root Guard to restrict who can become the root (place on ports facing potential rogue roots). Use Loop Guard to handle BPDU loss on non-designated ports (place on uplinks/downlinks where unidirectional failures are risky). Avoid BPDU Guard on switch-to-switch links unless explicitly configured as edge ports with strict isolation requirements, which is rare for core/uplink infrastructure.
Frequently Asked Questions
What is the difference between Root Guard and Loop Guard?
Why not use BPDU Guard on uplinks?
Community Votes
50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
bp3t3r_ 👍 1A and E. You would enable BPDU guard on client facing ports where you don't want to receive BPDUs at all.
-
drinu89 👍 1A. Loop guard on uplink E. Root guard on downlink
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 300-420 Questions
Access 150 questions with complete answers and detailed explanations.
View Full 300-420 Practice Test →