Police records places a safeguard on distribution downlinks so an access switch cannot take over as spanning-tree root. Which feature provides that control?
Select an answer to reveal the explanation.
Short Explanation
You can think of root guard as the “you don’t get to run the election from the closet” sign on distribution downlinks. If an access switch claims a better bridge ID, you keep that port from accepting the superior BPDUs and crowning the wrong root.
Full Explanation
Police-records distribution downlinks need protection against an access switch winning the root election with superior BPDUs. Root guard on those downlinks provides that control: if a downstream switch advertises a better bridge ID, the port enters a root-inconsistent state rather than accepting that switch as root, helping the intended core retain root placement. This makes root guard the STP control for protecting root placement at the distribution-to-access boundary. PortFast on distribution uplinks does not make access switches inherit root priority; PortFast is not a way to assign the root and is misapplied to interswitch links. LLDP-MED policy maps do not override bridge priority carried in BPDUs, because discovery policies and STP elections are separate. Setting LACP max-bundle to 1 limits the number of EtherChannel members; it does not disable campus-wide STP root election or protect root placement. Exam caveat: root guard belongs on ports expected to remain designated toward a downstream region, not on links where a legitimate superior BPDU should be accepted. Practical check: apply root guard to distribution interfaces facing access stacks, verify the intended core remains root, and in a lab simulate a superior BPDU from an access switch to confirm root-inconsistent behavior; document the police-records STP protection standard.