Cisco CCNP Enterprise 350-401 ENCOR RSTP MST and Spanning-Tree Protection Practice Test

 

Topic 07 covers rstp, mst and spanning-tree protection for the Cisco Certified Specialist – Enterprise Core certification. These original practice questions apply the verified 350-401 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

For VLAN 20, SW1 has bridge priority 24576 and MAC 00:00:00:00:10:10. SW2 has priority 28672 and a numerically lower MAC. SW3 has priority 32768. Which switch becomes the root bridge?

1. SW2, because the lowest MAC address always wins.
2. SW2, because 28672 is numerically closest to zero after adding the VLAN ID.
3. The root cannot be determined without port costs.
4. SW1; its lower bridge priority wins before the MAC tie-break.
5. SW3, because 32768 is the default root priority.

Correct Answer: D

 

Correct Answer

Answer D is correct because STP compares the bridge ID beginning with priority; SW1 has the lowest priority value.

Incorrect Answers

Answer A is incorrect because MAC address breaks a tie only after the priority values are equal.

Answer B is incorrect because 24576 remains lower than 28672 for the same VLAN extended system ID.

Answer C is incorrect because port costs select paths toward the root after the root bridge is elected; they do not determine the root bridge ID.

Answer E is incorrect because the default does not outrank explicitly lower priority values.

 

Question 2

Three switches in VLAN 100 all have the same configured STP priority. Their base MAC addresses are SW1 00:00:00:00:00:30, SW2 00:00:00:00:00:10, and SW3 00:00:00:00:00:20. Which switch is elected root if no other factor differs?

1. SW3, because the median MAC avoids a tie.
2. SW2; the lower MAC wins the equal-priority tie.
3. The switch whose uplink came up first.
4. SW1, because the highest MAC is most authoritative.
5. The switch with the lowest root-path cost.

Correct Answer: B

 

Correct Answer

Answer B is correct because with equal priority and the same VLAN context, the lowest MAC address wins the bridge-ID comparison.

Incorrect Answers

Answer A is incorrect because there is no median-based STP rule. It does not satisfy the stem’s governing point: When bridge priorities tie, the lower MAC address breaks the root-election tie.

Answer C is incorrect because link timing does not supersede the bridge-ID election rule in the stable topology.

Answer D is incorrect because STP selects the numerically lowest bridge ID, not the highest MAC.

Answer E is incorrect because root-path cost is calculated toward the already elected root and does not elect the root bridge.

 

Question 3

Distribution-1 is intended to be root for VLAN 10 and Distribution-2 for VLAN 20. Both VLANs currently use the same root because all switches retain defaults. Which design action most directly implements the intended per-VLAN topology in Rapid PVST+?

1. Increase access-switch port costs equally in both VLANs.
2. Lower each intended root’s priority for its VLAN.
3. Configure VLAN 20 as the native VLAN everywhere.
4. Set one global switch MAC address lower for Distribution-1.
5. Disable STP on VLAN 20.

Correct Answer: B

 

Correct Answer

Answer B is correct because Rapid PVST+ maintains a spanning-tree instance per VLAN, allowing intentional per-VLAN root placement.

Incorrect Answers

Answer A is incorrect because equal access changes do not establish distinct intended roots.

Answer C is incorrect because native VLAN treatment does not select the STP root.

Answer D is incorrect because changing a base MAC would not create different root placement per VLAN.

Answer E is incorrect because removing loop prevention is not a valid way to create a planned alternate root.

 

Question 4

SW-A is current root for VLAN 30 with priority 24576. An engineer changes SW-B from 32768 to 20480 for VLAN 30 while all links remain stable. What topology-level effect should be expected after reconvergence?

1. No change occurs because root priority is read only at boot.
2. Only the native VLAN root changes.
3. SW-B should become root because its new bridge priority is lower.
4. SW-A remains root until its MAC address changes.
5. Both switches become simultaneous roots for VLAN 30.

Correct Answer: C

 

Correct Answer

Answer C is correct because the deliberate priority reduction makes SW-B advertise a superior bridge ID for that VLAN.

Incorrect Answers

Answer A is incorrect because BPDUs communicate changed bridge information and trigger spanning-tree recalculation.

Answer B is incorrect because the command is scoped to VLAN 30 rather than to native status.

Answer D is incorrect because a lower competing priority can supersede the current root without a MAC change.

Answer E is incorrect because a stable STP instance elects one root bridge.

 

Question 5

A technician on Access-3 runs `show spanning-tree vlan 50` and sees `This bridge is the root`. On Distribution-1, the same command shows a different root ID and the uplink toward Access-3 is blocking due to a misconfigured VLAN boundary. Which conclusion is safest?

1. MAC learning chooses the root independently on each switch.
2. Distribution-1 must accept Access-3 as root because Access-3 says it is root.
3. The discrepancy proves VLAN 50 is routed rather than switched.
4. Access-3 is isolated from superior BPDUs and has an incomplete root view.
5. The network has permanently elected two valid roots for one spanning-tree instance.

Correct Answer: D

 

Correct Answer

Answer D is correct because a switch can believe itself root when it does not receive superior BPDUs, but another connected domain can have a different actual root.

Incorrect Answers

Answer A is incorrect because root selection depends on BPDUs and bridge IDs, not data-plane MAC-table learning.

Answer B is incorrect because local output reflects received information and may be incomplete across the fault.

Answer C is incorrect because the outputs explicitly show spanning-tree state and a BPDU/topology boundary issue.

Answer E is incorrect because two simultaneous roots indicate segmentation or control-message isolation rather than a valid stable single instance.

 

Question 6

A non-root switch has two uplinks to the root bridge. Path A has total STP cost 8; Path B has total cost 12. No other tie-break applies. Which port becomes the root port?

1. The port with the higher local interface number.
2. The port on Path A.
3. The port on Path B because a higher cost means a stronger preference.
4. Neither; only the root bridge has a root port.
5. Both ports forward as root ports.

Correct Answer: B

 

Correct Answer

Answer B is correct because the root port is the local port that offers the lowest root-path cost.

Incorrect Answers

Answer A is incorrect because interface ID is used only after more significant tie-breaks, not instead of lower root-path cost.

Answer C is incorrect because STP prefers lower path cost, not higher. It does not satisfy the stem’s governing point: A non-root switch selects the lowest-cost path toward the root as its root port.

Answer D is incorrect because the root bridge has no root port; non-root bridges select one.

Answer E is incorrect because a non-root bridge selects a single root port per spanning-tree instance under ordinary conditions.

 

Question 7

SW3 receives equally good root-path cost advertisements over two point-to-point links. Neighbor SW1 has bridge ID 24576:0000.0000.0010 and SW2 has 24576:0000.0000.0020. Local port priorities/costs are equal. Which neighbor path wins next in the tie-break?

1. The path with the higher VLAN ID.
2. Both become root ports because the costs match.
3. The path through SW2 because the higher MAC indicates a newer switch.
4. The path selected by EtherChannel hashing.
5. The path through SW1 because the upstream sender bridge ID is lower.

Correct Answer: E

 

Correct Answer

Answer E is correct because after equal root ID and root-path cost, the superior sender bridge ID wins before lower-level port tie-breaks.

Incorrect Answers

Answer A is incorrect because both links participate in the same instance/VLAN and VLAN ID is not a tie-break between senders here.

Answer B is incorrect because the switch still resolves a deterministic single root port using subsequent tie-break fields.

Answer C is incorrect because STP compares the numeric bridge ID and prefers the lower value.

Answer D is incorrect because these are separate point-to-point STP links, not members of one port channel.

 

Question 8

On a shared Ethernet segment, SW-A has root-path cost 4 and SW-B has root-path cost 8. Neither is the root bridge. Which switch normally supplies the designated port for that segment, all else equal?

1. SW-A supplies the designated port for that segment.
2. The switch with the higher interface number regardless of path cost.
3. Neither, because designated ports exist only on the root bridge.
4. Both, because every non-root switch has one designated port.
5. SW-B, because the higher cost means it needs the segment more.

Correct Answer: A

 

Correct Answer

Answer A is correct because the designated bridge for a segment is the one offering the best path toward the root.

Incorrect Answers

Answer B is incorrect because port ID is a later tie-break and does not override a lower root-path cost.

Answer C is incorrect because root ports and designated ports exist on non-root switches too; each LAN segment selects a designated side.

Answer D is incorrect because each segment has one designated forwarding port in the stable tree.

Answer E is incorrect because designated selection prefers superior, not inferior, path information.

 

Question 9

SW4 has one root port and a second link toward the same upstream topology that is currently an RSTP alternate port in discarding state. What is the role of the alternate port?

1. It carries only native VLAN traffic while discarding tagged traffic.
2. It is the current best root path and must forward user traffic.
3. The alternate port can transition if the current root path fails.
4. It is designated for the attached segment and therefore forwards.
5. It is an endpoint edge port that bypasses STP.

Correct Answer: C

 

Correct Answer

Answer C is correct because RSTP keeps a redundant path in the alternate role so it can transition when the current root path is lost.

Incorrect Answers

Answer A is incorrect because the STP role controls forwarding for the instance rather than selecting tagged versus untagged frames.

Answer B is incorrect because the root port is the selected active path; an alternate is not forwarding in the stable topology.

Answer D is incorrect because an alternate port receives superior information and is not the designated forwarding side.

Answer E is incorrect because alternate describes redundant topology position, not an endpoint edge classification.

 

Question 10

SW2 reaches the root through Gi1/0/1. Gi1/0/2 is an alternate path. Gi1/0/1 fails physically. Assuming RSTP has a valid alternate and no other topology changes, what role transition is expected?

1. STP disables Gi1/0/2 because alternate ports are error conditions.
2. Gi1/0/2 must remain permanently discarding because roles never change after election.
3. The alternate path can become the new root port and transition to forwarding as convergence completes.
4. Every designated port in the network becomes a root port.
5. The root bridge must be re-elected even if it remains reachable over Gi1/0/2.

Correct Answer: C

 

Correct Answer

Answer C is correct because loss of the active root path triggers selection of the best surviving path, commonly the prior alternate.

Incorrect Answers

Answer A is incorrect because alternate is a normal redundancy role, not an error-disabled condition.

Answer B is incorrect because STP roles are recalculated when topology information changes.

Answer D is incorrect because only the affected bridge selects its root port; roles remain constrained by the topology.

Answer E is incorrect because a local path failure does not require changing the root if the same root is still reachable.

 

Question 11

Two RSTP switches are connected by a full-duplex point-to-point link. A new designated port proposes rapid transition and the neighbor can safely synchronize its other relevant ports. What mechanism enables faster forwarding than legacy timer-only convergence?

1. Use the RSTP proposal/agreement handshake on the point-to-point link.
2. Native VLAN tagging.
3. EtherChannel hashing.
4. DTP trunk negotiation.
5. OSPF hello/dead timers.

Correct Answer: A

 

Correct Answer

Answer A is correct because RSTP can rapidly confirm a loop-free relationship using synchronization and agreement rather than wait through legacy forward-delay timers.

Incorrect Answers

Answer B is incorrect because tagging behavior does not replace spanning-tree convergence logic.

Answer C is incorrect because hashing distributes traffic across a formed channel and does not transition STP port states.

Answer D is incorrect because DTP chooses trunk mode and does not provide the RSTP topology handshake.

Answer E is incorrect because OSPF is a Layer 3 routing protocol unrelated to Layer 2 RSTP agreement.

 

Question 12

A user PC is the only device attached to a switch access port. The port must begin forwarding quickly when the PC connects, but the network still wants protection if BPDUs unexpectedly arrive. Which combination best fits?

1. Configure the port as an MST region boundary.
2. Make the port an RSTP root port and enable root guard.
3. Treat the port as an edge/PortFast port and enable BPDU guard.
4. Disable spanning tree on the entire VLAN.
5. Increase the STP path cost so the PC forwards faster.

Correct Answer: C

 

Correct Answer

Answer C is correct because edge treatment permits rapid forwarding for an endpoint, while BPDU guard can disable the port if switch-like BPDUs appear unexpectedly.

Incorrect Answers

Answer A is incorrect because a PC connection does not constitute an MST region.

Answer B is incorrect because an endpoint-facing access port is not intended to become the path to the root.

Answer D is incorrect because that removes loop protection rather than optimizing a known endpoint edge.

Answer E is incorrect because path cost influences topology selection, not endpoint startup transition.

 

Question 13

An RSTP port is in discarding state. Which TWO behaviors are consistent with that state? Choose TWO.

1. It must learn and forward all source MAC addresses immediately.
2. It does not forward user data frames.
3. It is necessarily physically down.
4. It carries IP routing updates while blocking only broadcasts.
5. It can still participate in spanning-tree control processing such as receiving BPDUs.

Correct Answers: B, E

 

Correct Answers

Answer B is correct because discarding prevents data-plane forwarding while the topology is not using that port for active service.

Answer E is correct because control-plane BPDU processing is needed to maintain or change the port role even when data forwarding is blocked.

Incorrect Answers

Answer A is incorrect because discarding does not perform normal data forwarding/learning as a forwarding port would.

Answer C is incorrect because a physically up redundant port can legitimately be in a discarding STP role.

Answer D is incorrect because STP data-plane blocking is not limited to broadcast traffic and does not provide a separate routed exception on the same Layer 2 port.

 

Question 14

A Rapid PVST+ switch connects to a legacy 802.1D STP neighbor on one segment. What should an engineer avoid assuming about that segment?

1. Do not assume the segment can carry VLAN traffic.
2. Do not assume the legacy switch has a MAC address.
3. Do not assume BPDUs can cross the segment at all.
4. Do not assume the RSTP switch can participate in root election.
5. Do not assume every transition on that segment will retain full RSTP rapid-convergence behavior.

Correct Answer: E

 

Correct Answer

Answer E is correct because interoperation with legacy STP can require compatibility behavior and does not guarantee the same rapid mechanisms end to end.

Incorrect Answers

Answer A is incorrect because STP version compatibility does not inherently prevent normal Layer 2 forwarding after convergence.

Answer B is incorrect because bridge identity remains part of STP operation. It does not satisfy the stem’s governing point: Legacy STP interoperability can constrain rapid transition behavior; compatibility is not the same as end-to-end RSTP speed.

Answer C is incorrect because RSTP is designed to interoperate with legacy STP rather than make BPDU exchange impossible.

Answer D is incorrect because the RSTP switch still participates in spanning-tree election and path selection.

 

Question 15

RSTP reconverges in less than a second after an uplink failure, and Layer 2 pings resume. A stateful application session still drops because its server-side transport state timed out during a separate firewall event. Which conclusion is correct?

1. STP should replicate firewall connection tables during topology changes.
2. The application loss proves RSTP did not reconverge.
3. The only valid metric for RSTP is whether every application session survives.
4. Successful rapid Layer 2 convergence does not guarantee application-session continuity across independent stateful dependencies.
5. The firewall should be elected as the STP root to preserve sessions.

Correct Answer: D

 

Correct Answer

Answer D is correct because RSTP restores a forwarding topology, but application and firewall state are separate layers with their own failure behavior.

Incorrect Answers

Answer A is incorrect because spanning tree has no function for firewall transport-state synchronization.

Answer B is incorrect because restored pings are direct evidence that the Layer 2 path recovered even though an application dependency did not.

Answer C is incorrect because protocol convergence and application continuity are related but not identical outcomes.

Answer E is incorrect because STP root placement does not supply firewall connection state.

 

Question 16

Two adjacent MST switches use the same revision and the same VLAN-to-instance mapping, but one region name is `CAMPUS-A` and the other is `CAMPUS-B`. What is the result?

1. The lower alphabetical name wins and propagates.
2. They merge regions automatically after exchanging BPDUs.
3. They are separate MST regions because their configured region names differ.
4. They remain in the same region because the revision matches.
5. Only VLAN 1 is affected by a region-name mismatch.

Correct Answer: C

 

Correct Answer

Answer C is correct because MST region membership requires matching name, revision, and VLAN-to-instance mapping.

Incorrect Answers

Answer A is incorrect because region names are compared for consistency rather than elected by lexical order.

Answer B is incorrect because MST does not rewrite the configured region identity to make mismatched switches match.

Answer D is incorrect because revision alone is insufficient when another required region attribute differs.

Answer E is incorrect because the region identity applies to the MST configuration, not one VLAN.

 

Question 17

Three switches are intended to be in one MST region. All use name `HQ` and identical instance mappings. SW1/SW2 use revision 10; SW3 uses revision 11. Which correction is required?

3. Make the revision number consistent with the region standard on SW3.
4. Remove all VLAN mappings from SW1 and SW2.
5. Use a different revision on every switch to ensure uniqueness.
6. Change SW3 bridge priority instead.
7. Make SW3 the CIST root and leave the mismatch.

Correct Answer: A

 

Correct Answer

Answer A is correct because revision is one of the MST region configuration attributes that must match.

Incorrect Answers

Answer B is incorrect because destroying the intended instance design is unnecessary; the isolated mismatch is the revision.

Answer C is incorrect because MST region members need matching, not unique, revision values.

Answer D is incorrect because bridge priority selects topology roles but does not repair region-membership identity.

Answer E is incorrect because root status does not cause different region identities to merge.

 

Question 18

SW1 and SW2 both use MST region name `DC` and revision 5. SW1 maps VLANs 10-19 to MST instance 1; SW2 maps VLANs 10-18 to instance 1 and VLAN 19 to instance 2. What is the key consequence?

1. Only VLAN 19 is ignored while the switches remain fully in one region for all other instances.
2. Revision 5 overrides any mapping mismatch.
3. The higher instance number automatically wins for VLAN 19.
4. The switches must use the same MAC address to repair the digest.
5. The switches have different MST configuration digests and operate as different region members at that boundary.

Correct Answer: E

 

Correct Answer

Answer E is correct because VLAN-to-instance mapping is part of the MST region configuration and must match exactly.

Incorrect Answers

Answer A is incorrect because a mapping mismatch changes the region identity, not merely one VLAN data-plane entry.

Answer B is incorrect because matching revision does not compensate for a different VLAN mapping.

Answer C is incorrect because instance mappings are configuration, not an election. It does not satisfy the stem’s governing point: A VLAN-to-instance mapping mismatch makes two otherwise similar MST configurations different regions.

Answer D is incorrect because bridge MAC does not define MST region configuration identity.

 

Question 19

An MST link connects Region EAST to Region WEST. Both regions are internally healthy. From the perspective of each region, what is this inter-region link?

1. A requirement that both sides renumber all VLANs.
2. A region boundary where common spanning-tree information represents the external topology.
3. A link that can forward only the IST VLANs.
4. An internal link that merges every MST instance number end to end.
5. A trunk on which STP is disabled automatically.

Correct Answer: B

 

Correct Answer

Answer B is correct because distinct region configurations meet at a boundary and are represented externally through the common spanning-tree behavior.

Incorrect Answers

Answer A is incorrect because VLAN numbering does not have to be changed just because regions differ.

Answer C is incorrect because region boundary behavior concerns control-tree representation, not a blanket prohibition on other VLAN traffic.

Answer D is incorrect because different regions do not become one simply because their instance numbers happen to overlap.

Answer E is incorrect because region boundaries still participate in spanning-tree control. It does not satisfy the stem’s governing point: Different MST regions meet at a boundary and are represented through common spanning-tree behavior rather than merged internal instances.

 

Question 20

Two separate MST regions each use local instance number 1, but Region A maps VLANs 10-19 to it and Region B maps VLANs 100-109 to its instance 1. Which statement is most accurate?

1. The two regions must renumber one instance because duplicate instance numbers are globally prohibited.
2. The regions are actually one region because they both configured instance 1.
3. Instance 1 is local to each region; a matching number does not merge regions.
4. The region with the lower VLAN numbers owns instance 1 globally.
5. Instance 1 automatically spans both regions and includes all VLANs 10-19 and 100-109.

Correct Answer: C

 

Correct Answer

Answer C is correct because region name/revision/mapping define the region, and local instance numbering does not merge independent configurations.

Incorrect Answers

Answer A is incorrect because instance identifiers can be reused in different regions.

Answer B is incorrect because matching one local instance number is insufficient for region identity.

Answer D is incorrect because there is no VLAN-number ownership election across regions.

Answer E is incorrect because a shared integer does not override the distinct region configurations.

 

Question 21

An MST region has VLANs 10-19 and 20-29. The design wants one spanning-tree topology for each VLAN group rather than one topology per VLAN. Which mapping meets that goal?

1. Leave the VLANs unmapped and configure one root port per VLAN manually.
2. Create a unique MST instance for every individual MAC address.
3. Put all VLANs into the same instance and rely on DTP for load sharing.
4. Map each physical uplink to an MST instance without referencing VLANs.
5. Map VLANs 10-19 to one MST instance and VLANs 20-29 to a second MST instance.

Correct Answer: E

 

Correct Answer

Answer E is correct because MST lets multiple VLANs share an instance while different groups can use different trees.

Incorrect Answers

Answer A is incorrect because unmapped VLANs follow the common/internal spanning-tree instance rather than two intended group topologies.

Answer B is incorrect because instances map VLANs, not endpoint MAC addresses. It does not satisfy the stem’s governing point: MST scales by mapping groups of VLANs to shared spanning-tree instances.

Answer C is incorrect because one instance gives one topology for both groups; DTP does not select spanning-tree paths.

Answer D is incorrect because MST mappings associate VLANs to instances, while port roles are computed from each instance topology.

 

Question 22

Distribution-A and Distribution-B have two parallel routed-free Layer 2 paths. For MST instance 1 the design wants A to be root; for instance 2 it wants B to be root, so different VLAN groups prefer different uplinks. Which control implements that intent?

2. Change native VLAN on one uplink for instance 2.
3. Use LACP hashing to select which switch is root.
4. Make A root for instance 1 and B root for instance 2 using lower priorities.
5. Configure both distributions with identical priority for every instance.
6. Disable the IST so only instances 1 and 2 exist.

Correct Answer: C

 

Correct Answer

Answer C is correct because each MST instance can elect its own root, allowing deliberate topology/load sharing by VLAN group.

Incorrect Answers

Answer A is incorrect because native VLAN is a trunk property, not an MST root-selection mechanism.

Answer B is incorrect because EtherChannel hashing distributes flows; it does not elect spanning-tree roots.

Answer D is incorrect because that leaves root choice to later bridge-ID tie-breaks and does not encode the intended split.

Answer E is incorrect because MST relies on the common/internal framework; disabling it is not the required load-sharing method.

 

Question 23

In an MST region, VLAN 77 is not explicitly listed under any nonzero instance mapping. Where does it participate by default within the region?

1. The Internal Spanning Tree / MST instance 0.
2. The highest numbered configured instance.
3. No spanning tree at all.
4. A new dynamic instance named 77.
5. The native VLAN instance only if VLAN 77 is untagged.

Correct Answer: A

 

Correct Answer

Answer A is correct because VLANs not explicitly mapped to another MST instance remain associated with instance 0 in the region configuration.

Incorrect Answers

Answer B is incorrect because MST does not auto-assign unmapped VLANs to the largest instance number.

Answer C is incorrect because lack of a nonzero mapping does not disable spanning tree.

Answer D is incorrect because MST does not create an instance per unmapped VLAN automatically.

Answer E is incorrect because instance mapping is independent of trunk native status.

 

Question 24

MST instance 1 uses Distribution-A as root and forwards uplink A from an access switch while uplink B is alternate. Instance 2 uses Distribution-B as root, reversing those roles. Which TWO statements follow? Choose TWO.

1. The same physical port can have different STP roles in different MST instances.
2. LACP is required to make instance-specific port roles possible.
3. Every VLAN must use the same forwarding uplink because the physical topology is shared.
4. VLANs mapped to instance 1 can prefer uplink A while VLANs mapped to instance 2 can prefer uplink B.
5. The design creates a Layer 2 loop because two instances have different roots.

Correct Answers: A, D

 

Correct Answers

Answer A is correct because port role is computed per spanning-tree instance, so a port can forward for one instance and be alternate for another.

Answer D is correct because different instance topologies allow grouped VLAN traffic to use different active Layer 2 paths.

Incorrect Answers

Answer B is incorrect because MST role computation does not require the links to be one EtherChannel.

Answer C is incorrect because MST exists specifically to allow multiple logical spanning trees over the same physical links.

Answer E is incorrect because each instance remains loop-free independently even when their preferred paths differ.

 

Question 25

A campus intended to load-share two VLAN groups across two MST instances, but an audit shows every VLAN is mapped to instance 0 and both uplinks therefore use the same forwarding/blocking pattern. What configuration defect defeats the design?

1. The access switch has two physical uplinks.
2. The VLAN groups were never mapped to distinct MST instances.
3. The trunks carry more than one VLAN.
4. The links use 802.1Q tags.
5. The root bridge has a MAC address.

Correct Answer: B

 

Correct Answer

Answer B is correct because without separate instance membership, all the VLANs follow the same IST topology and cannot realize the planned split.

Incorrect Answers

Answer A is incorrect because redundant links are the topology over which spanning-tree instances can choose different active paths.

Answer C is incorrect because MST is specifically designed for multivlan Layer 2 networks.

Answer D is incorrect because tagging does not prevent MST instance-specific root/path selection.

Answer E is incorrect because every bridge needs an identifier; that does not explain why all VLANs use instance 0.

 

Question 26

A service-provider-facing access switch port should never allow the downstream customer switch to become the campus root. The customer begins sending superior BPDUs. Which feature best enforces that topology boundary while still allowing normal BPDUs when they are not superior?

1. LACP passive.
2. PortFast alone.
3. DTP nonegotiate.
4. BPDU guard.
5. Root guard.

Correct Answer: E

 

Correct Answer

Answer E is correct because root guard prevents a designated-facing port from accepting a superior downstream root and places the port into root-inconsistent state while superior BPDUs persist.

Incorrect Answers

Answer A is incorrect because LACP controls channel negotiation rather than STP root authority.

Answer B is incorrect because edge/PortFast speeds transition and does not stop a downstream switch from advertising superior root information.

Answer C is incorrect because DTP affects trunk negotiation and not spanning-tree root election.

Answer D is incorrect because BPDU guard is intended to treat any BPDU on a protected edge port as a violation, not specifically block only superior root claims.

 

Question 27

A true endpoint-facing PortFast access port should never have a switch attached. The port receives a BPDU after someone connects an unmanaged lab switch. Which control is intended to fail closed for this condition?

1. BPDU guard, which can error-disable the protected edge port on BPDU receipt.
2. OSPF passive interface.
3. Root guard, which only checks whether the BPDU is superior.
4. MST revision checking.
5. Port-channel minimum links.

Correct Answer: A

 

Correct Answer

Answer A is correct because BPDU guard treats a received BPDU as evidence the edge assumption has been violated.

Incorrect Answers

Answer B is incorrect because OSPF is unrelated to Layer 2 BPDUs. It does not satisfy the stem’s governing point: BPDU guard protects an edge assumption by treating unexpected BPDUs as a port violation.

Answer C is incorrect because an endpoint edge should not receive any bridge BPDU, so limiting enforcement to superior information is weaker than the stated policy.

Answer D is incorrect because region consistency does not protect a generic endpoint edge from an attached switch.

Answer E is incorrect because minimum-links is an aggregation availability control, not an STP edge protection mechanism.

 

Question 28

An interface with root guard receives a superior BPDU. `show spanning-tree inconsistentports` lists it as root-inconsistent. How does this differ from a BPDU-guard violation?

1. Root guard applies only to routed ports.
2. Root-inconsistent means the physical cable is down, while BPDU guard means it is up.
3. Root guard creates root-inconsistent blocking; BPDU guard normally error-disables an edge port.
4. BPDU guard only changes bridge priority and never affects the port.
5. Both states are identical aliases shown by different commands.

Correct Answer: C

 

Correct Answer

Answer C is correct because the two protections use different enforcement states and trigger semantics.

Incorrect Answers

Answer A is incorrect because root guard is a spanning-tree Layer 2 protection feature.

Answer B is incorrect because root-inconsistent is a protocol protection state and can occur on a physically up link.

Answer D is incorrect because BPDU guard is specifically designed to disable a protected port on unexpected BPDUs.

Answer E is incorrect because root guard and BPDU guard are distinct features with different triggers and recovery.

 

Question 29

A root-guarded port is root-inconsistent because a downstream switch is advertising a superior root. The downstream switch is reconfigured to a worse priority and stops sending superior information. No other fault exists. What recovery behavior is expected?

1. The port must always be physically replaced.
2. The root-guarded port can automatically return to normal spanning-tree operation after superior BPDUs cease.
3. The downstream switch must change its VLAN IDs.
4. The entire switch must reload because root guard is permanent.
5. LACP must renegotiate before STP can recover, even on a single link.

Correct Answer: B

 

Correct Answer

Answer B is correct because root guard dynamically protects the topology and does not require permanent errdisable recovery when the superior-root condition clears.

Incorrect Answers

Answer A is incorrect because the condition is control-plane information, not a hardware failure.

Answer C is incorrect because removing the superior root claim is sufficient; VLAN renumbering is unrelated.

Answer D is incorrect because root guard is not a one-time permanent lockout.

Answer E is incorrect because the root-guard recovery is based on BPDU condition, not EtherChannel negotiation.

 

Question 30

A network team enables BPDU guard on a PortFast access port used for a printer. Months later the printer is replaced with a legitimate small Cisco switch to serve four desks, and the port immediately error-disables on BPDUs. What is the correct interpretation?

1. Disable STP on the new switch so the edge design remains safe.
2. Enable root guard and BPDU guard simultaneously to guarantee the port forwards.
3. BPDU guard is working; the port is no longer being used as a pure endpoint edge.
4. The Cisco switch must be faulty because legitimate switches never send BPDUs.
5. Change the printer VLAN only; BPDU guard checks VLAN membership rather than BPDUs.

Correct Answer: C

 

Correct Answer

Answer C is correct because a legitimate switch is still a bridge sending BPDUs, which violates the original edge assumption enforced by BPDU guard.

Incorrect Answers

Answer A is incorrect because suppressing loop prevention is not a sound substitute for redesigning a port that now connects another bridge.

Answer B is incorrect because additional guard features do not make a bridge connection compatible with an endpoint-only policy.

Answer D is incorrect because normal switches participate in spanning tree and therefore send/receive BPDUs.

Answer E is incorrect because the trigger is receipt of a BPDU on the guarded port.