BPDU Guard on access-sw01: What State Results After Receiving BPDUs?

N10-009 By islever Editorial Last updated

Given a scenario, configure switching technologies and features. Given a scenario, apply network security features, defense techniques, and solutions.

Short answer

B Because access-sw01 has BPDU Guard enabled on Ethernet 0/5, receiving a BPDU from the distribution switch err-disables that interface.

Question

A network engineer connected a cable between a distribution switch and an access layer switch. The engineer performs the show running configuration command on both switch interfaces. Based on the configuration output:
Exhibit: BPDU Guard on access-sw01: What State Results After Receiving BPDUs?
Which of the following is the state of the access-sw01 interface?
  1. Administratively down
  2. Error disabled Correct Answer
  3. Suspended
  4. Line protocol down

Key Takeaways

This question tests whether you can recognize BPDU Guard's err-disable action when a switch-to-switch link feeds BPDUs into an access port, rather than confusing it with admin-down, suspended, or line-protocol-down states.

BPDU Guard is a Spanning Tree protection feature that err-disables a switch port when it receives a BPDU. Here, access-sw01's Ethernet 0/5 is error disabled, making B the answer.

Common mistake: Choosing D (Line protocol down) because the link is physically connected; BPDU Guard does not merely bring the line protocol down—it places the port in an error-disabled state after receiving a BPDU.

Expert Analysis

The trigger on access-sw01

The exhibit shows spanning-tree bpduguard enable under access-sw01's Ethernet 0/5 interface. BPDU Guard is a Spanning Tree protection feature intended for ports that should connect only to end stations. It does not negotiate with a neighboring switch; it watches for Bridge Protocol Data Units and treats any received BPDU as a violation. The discussion reasoning makes the same point: because access-sw01 is cabled to another switch, the other switch sends BPDUs, and access-sw01 reacts immediately rather than forwarding normally.

What state results

When BPDU Guard receives a BPDU on a protected port, Cisco's documented behavior is to put that port into the error-disabled (err-disabled) state. Traffic stops, and the port must be recovered manually or by err-disable recovery. That makes option B correct. The interface is not simply blocked by spanning tree and it is not left in a normal STP state.

Why the other states do not fit

Option A would require shutdown under the interface; the scenario's configuration includes BPDU Guard, not an administrative shutdown. Option C, suspended, is associated with other conditions such as an inactive VLAN or certain port-state dependencies, not with a BPDU Guard violation. Option D, line protocol down, describes a link where physical connectivity exists but Layer 2 is not operational; BPDU Guard's deliberate action is stronger and produces an err-disabled port. The distinction matters because show running-config reveals the guard setting, while the resulting operational state is reported by commands such as show interfaces status.

Exam takeaway

The governing principle is cause-and-effect: a BPDU received on a BPDU Guard-enabled access port causes err-disable. Map the scenario's switch-to-switch connection to that rule before considering the distractors.

Official Reference

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/stp/configuration/15-mt/stp-15-mt-book.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When an exhibit shows spanning-tree bpduguard enable on an access-facing port and the topology links that port to another switch, predict the err-disable state before reading the choices. Separate configuration-derived state from operational state: shutdown causes administratively down, missing link can cause line protocol down, and VLAN issues can suspend a port, but BPDU Guard triggers err-disabled. On exam questions, map each option to its exact trigger and eliminate those unsupported by the running configuration.

Frequently Asked Questions

What exactly does BPDU Guard do when it receives a BPDU?

It places the receiving port into the err-disabled state, which blocks traffic until the port is manually recovered or err-disable recovery is configured. BPDU Guard is meant for ports connected to end devices, not other switches.

Why is the answer not line protocol down?

Line protocol down means Layer 1 is up but Layer 2 is not operational. BPDU Guard responds to a valid BPDU by err-disabling the port, so the operational status is error disabled rather than just line protocol down.

How can an err-disabled port be recovered?

Remove the condition that caused it—here, disconnect the switch or remove BPDU Guard from that access port—then shut and no shut the interface, or enable errdisable recovery. Verify the cause with show interfaces status err-disabled.

More N10-009 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. ERB14 👍 1 Answered B
    BPDU Guard (spanning-tree bpduguard enable): On access-sw01, the interface Ethernet 0/5 has BPDU Guard explicitly enabled. When access-sw01 is connected to another switch (access-sw02), access-sw02 sends Spanning Tree Protocol (STP) Bridge Protocol Data Units (BPDUs) across the link. As soon as access-sw01 receives a BPDU on an interface with BPDU Guard active, it immediately shuts down the interface to prevent potential loops. The operational state resulting from this action is Error Disabled (err-disabled).

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Why does a moved 2.4GHz WAP cause intermittent laptop issues?

S-grade

How to Reduce Network Congestion and Improve Performance?

S-grade

Why did the telephone system lose connection with a working console and module access?

S-grade

What is the transport layer transmission format for connectionless communication?

S-grade

Practice All N10-009 Questions

Access 100 questions with complete answers and detailed explanations.

View Full N10-009 Practice Test →

← Back to N10-009 Study Guide