A university is refreshing 40 access closets with dual uplinks to distribution, 800 user ports for PCs and IP phones, and a history of outages when a fiber uplink flap caused loops. Edge ports must come up fast without waiting for STP, while uplinks must block loops if BPDUs stop arriving. Which Layer 2 convergence safeguard should the designer specify to satisfy fast edge bring-up and loop protection?

PortFast on edge ports lets host ports transition directly to forwarding because they connect to end devices that do not generate BPDUs or create loops, which satisfies the fast bring-up requirement without weakening the spanning-tree topology, while Loop Guard on point-to-point uplinks keeps a nondesignated port in a loop-inconsistent blocking state when BPDUs stop arriving so a unidirectional fiber failure or software failure cannot cause it to incorrectly transition to forwarding and create a loop. BackboneFast on uplinks only shortens convergence after indirect link failures by accelerating max-age expiry and does not block a port that stops receiving BPDUs, so it misses the loop-protection requirement. Disabling STP on edge ports with UplinkFast removes loop protection entirely and UplinkFast is a legacy access fast-failover mechanism that does not guard against unidirectional BPDU loss. Root Guard on host ports plus PortFast on uplinks inverts the design because Root Guard is meant to pin the root bridge placement on distribution-facing ports and PortFast must never be used on uplinks where a loop could form. For the exam, remember PortFast equals edge-only and Loop Guard equals guard against missing BPDUs, and in practice verify port roles with show spanning-tree inconsistentports and confirm edge ports never receive BPDUs.