Which mechanism enables small, unmanaged switches to plug into ports of access switches without risking switch loops?

PortFast bypasses STP listening and learning states to speed up port transitions to forwarding, but it does not disable the port when a downstream device sends BPDUs - it only changes transition timing.

UDLD detects unidirectional link failures caused by hardware or cabling issues, not the presence of downstream switches sending BPDUs.

Root Guard prevents a downstream port from becoming a root port by discarding superior BPDUs, but it does not err-disable the port and is intended for managing root bridge placement, not blocking rogue switch connections entirely.

BPDU Guard is designed specifically for ports where no STP BPDUs should ever arrive, such as end-user or access ports configured with PortFast. When an unmanaged switch is plugged in and begins sending BPDUs, BPDU Guard immediately transitions the port to err-disabled state, preventing the unmanaged switch from participating in or disrupting the STP topology and causing loops.