A fire district applies protection on PortFast edge ports so an unexpected switch cannot join the spanning tree through a wall jack. Which feature matches that goal?
Select an answer to reveal the explanation.
Short Explanation
You’re treating a PortFast jack as a place for a host, not another switch. BPDU guard is the bouncer: if a BPDU appears, it shuts the port instead of letting the unexpected switch affect the spanning tree.
Full Explanation
BPDU guard matches the fire district’s goal: when a BPDU appears on a PortFast edge port where only a host was expected, the port is typically error-disabled rather than allowing an unexpected switch to join Rapid PVST+ and possibly reshape the spanning tree. PortFast assumes the port connects to an edge host; BPDU guard enforces that assumption. UplinkFast is a legacy uplink-optimization concept, not an edge-port protection feature, and it does not make every PortFast edge port a backup root port to block unexpected switches. Dynamic ARP inspection validates ARP traffic against DHCP bindings; it does not block BPDUs. Native VLAN pruning does not drop BPDUs simply because they use VLAN 1 tags, and it is not the feature that error-disables an edge port when an unexpected BPDU arrives. Exam caveat: BPDU guard and BPDU filter are not interchangeable: guard protects by disabling a port on receipt of a BPDU, while filtering suppresses BPDU sending or receiving and can hide loops if misused on edge ports. Practical check: enable BPDU guard on all PortFast edge ports in the fire district access template, test with a lab switch to confirm the port becomes error-disabled, define a monitored recovery or ticketing process for disabled jacks, and leave guard off interswitch links where BPDUs are expected.