350-401 Question 133
Select 2A network administrator is configuring Spanning Tree Protocol (STP) on a network to ensure loop prevention. During configuration, the administrator wants to protect a specific switch from becoming the root bridge, regardless of any superior BPDUs received. Additionally, they need to ensure that access ports shut down when a BPDU is received. Which combination of features should the administrator configure to meet these requirements?
- A
Enable Root Guard on the designated switch ports
- B
Enable BPDU Guard on the designated switch ports
- C
Configure PortFast on the designated switch ports
- D
Set the bridge priority to the highest value on the switch
- E
Enable Loop Guard on the designated switch ports
Show answer and explanation
Correct answers: A, B
Explanation
To prevent a switch from becoming the root bridge, Root Guard should be enabled on ports connected to other switches. This ensures that superior BPDUs are ignored on those ports. Additionally, BPDU Guard should be enabled on access ports to prevent loops caused by devices that send unexpected BPDUs. These two features together meet the requirements of the scenario effectively, ensuring both root bridge protection and access port stability.
- A. Correct.
Root Guard ensures that the protected switch does not accept superior BPDUs on the configured ports, preventing it from becoming the root bridge.
- B. Correct.
BPDU Guard disables the port (err-disabled state) if a BPDU is received, which is ideal for access ports to prevent potential loops caused by misconfigurations.
- C. Incorrect.
PortFast is used to reduce the time a port spends in the STP listening and learning states, but it does not prevent the switch from becoming a root bridge or handle BPDU-based vulnerabilities directly.
- D. Incorrect.
Setting the bridge priority to the highest value makes it less likely for the switch to become the root bridge, but it does not guarantee prevention in all cases, especially if superior BPDUs are received.
- E. Incorrect.
Loop Guard is designed to protect against unidirectional link failures but does not prevent a switch from becoming the root bridge or shut down access ports upon BPDU receipt.