A manufacturing floor has frequent endpoint moves, redundant uplinks from access to distribution, and a history of outages from accidental loops when contractors connect unmanaged switches. Which fast convergence design using PortFast, uplink equivalents and loop guard best balances speed and safety?

The correct design works because PortFast on edge ports skips listening-learning for fast endpoint moves, BPDU guard err-disables the port if a contractor switch sends BPDUs to stop accidental loops, redundant uplinks with uplink-fast failover give rapid convergence without bypassing STP, and loop guard on point-to-point uplinks blocks forwarding when BPDUs stop during unidirectional failures. The Root Guard on uplinks design fails by concept because Root Guard only preserves root placement by blocking superior BPDUs in root-inconsistent state, it cannot detect absent BPDUs on the root port so a unidirectional uplink can still transition and loop, which loop guard specifically prevents. The design with PortFast, loop guard and UplinkFast but no BPDU guard fails by concept because uplink failover and loop detection do not secure the edge, a PortFast port without BPDU guard will stay forwarding when connected to an unmanaged switch and can create a loop or distort topology. The PortFast-everywhere design fails by concept because PortFast is safe only on terminal hosts, on uplinks it bypasses listening-learning and risks transient loops during changes where controlled uplink convergence plus loop guard is required. For exams distinguish BPDU guard for edge shutdown on BPDU versus BPDU filter for suppression, loop guard for BPDU loss on alternate ports versus Root Guard for root control, and UplinkFast for direct access failover versus BackboneFast for indirect failures. In practice verify with show spanning-tree summary, confirm PortFast edge-only, BPDU guard errdisable, and loop guard on uplinks, then test failover and rogue-switch insertion.