Acme Corporation wants to minimize the risk of users plugging unauthorized switches and hubs into the network. Which two features can be used on the LAN access ports to support this design…

The correct answer is A. BPDU Guard D. Root Guard. BPDU Guard (A) and Root Guard (D) both protect against unauthorized switches on access ports. BPDU Guard detects when any BPDU is received on an access port - which would only happen if an unauthorized switch running STP is plugged in - and immediately err-disables the port…

Layer 2 Control Plane

Question

Acme Corporation wants to minimize the risk of users plugging unauthorized switches and hubs into the network. Which two features can be used on the LAN access ports to support this design requirement? (Choose two.)

Options

ABPDU Guard
BPortFast
CLoop Guard
DRoot Guard
EDTP

How the community answered

(20 responses)

A
90% (18)
C
5% (1)
E
5% (1)

Explanation

BPDU Guard (A) and Root Guard (D) both protect against unauthorized switches on access ports. BPDU Guard detects when any BPDU is received on an access port - which would only happen if an unauthorized switch running STP is plugged in - and immediately err-disables the port, isolating the rogue device. Root Guard (D) prevents an unauthorized switch from winning the STP root bridge election: if the switch sends superior BPDUs to claim the root role, Root Guard places the port in a root-inconsistent blocking state. PortFast (B) only skips STP listening/learning states and does nothing to block unauthorized devices. Loop Guard (C) is used to prevent loops when BPDUs stop arriving, not to detect unauthorized switches. DTP (E) negotiates trunk links and has no role in preventing rogue switch attachments.

Topics

#BPDU Guard#Root Guard#STP security#unauthorized devices

Community Discussion

No community discussion yet for this question.

Full 352-001 Practice