Which mechanism enables small, unmanaged switches to plug into ports of access switches without risking switch loops?

PortFast accelerates port transitions to the forwarding state for end-host connectivity but does not disable a port when a BPDU is detected, leaving the network exposed to loops if a switch is connected.

UDLD detects unidirectional physical link failures caused by hardware faults such as faulty fiber strands and does not prevent bridging loops from being created by attaching switches.

Root guard prevents a port from accepting superior BPDUs that would displace the current root bridge, but it does not err-disable the port on receipt of any BPDU, so it does not fully protect against all loop scenarios introduced by connecting an unauthorized switch.

BPDU guard is deployed on PortFast-enabled access ports and works by placing a port into err-disabled state the instant any BPDU arrives; this prevents an unmanaged or rogue switch from introducing bridging loops or altering the spanning tree topology, as the port is shut down before STP can even begin negotiating with the connected device.