Refer to the exhibit. Your company designed a network to allow server VLANs to span all access switches in a data center. In the design, Layer 3 VLAN interfaces and HSRP are configured on the aggregat

BPDU guard on access ports immediately err-disables any port that receives a BPDU, preventing unauthorized switches from injecting topology change notifications and disrupting the STP domain.

Edge port (PortFast) only bypasses listening and learning states for faster end-device connectivity; it provides no protection against unauthorized BPDUs or STP topology instability.

Root guard on access ports facing end devices is ineffective because end devices do not send BPDUs; root guard protection must be applied on the aggregation downlinks where access switches connect.

BPDU guard on aggregation downlinks toward access switches would err-disable those ports upon receiving legitimate BPDUs from access switches, causing a network outage rather than improving stability.

Root guard on aggregation switch downlinks toward access switches blocks any port that receives a superior BPDU, ensuring access switches can never usurp the root bridge role and destabilize the intended topology.

Manually configuring root and backup root priority is a planning best practice but is not a proactive enforcement feature - it can still be overridden by a rogue switch with a lower bridge ID without root guard.