A school district wants edge access ports to err-disable if someone plugs in a rogue switch that starts sending BPDUs. Which feature best matches that requirement?

BPDU Guard on edge/access ports matches the school district’s goal: those ports should face end stations, not switches. If a rogue switch is plugged in and begins sending BPDUs, BPDU Guard err-disables the port instead of allowing the unauthorized bridge to participate in spanning-tree elections. That protective shutdown preserves the designed STP topology for classroom and office access layers and gives operators a clear fault signal (err-disabled) when someone introduces a switch where only a host should appear.

Root Guard only on core switches with no edge protection addresses a different threat—blocking superior BPDUs on guarded designated ports toward the root—so it does not meet the “err-disable when a rogue switch sends BPDUs on access ports” requirement by itself. Disabling spanning tree entirely on classroom closets removes loop protection and increases blast radius if redundant cables appear; it is the opposite of hardening. Enabling DTP desirable on every user port increases the chance of unintended trunks and does nothing to stop STP influence from a rogue bridge.

Exam caveat: BPDU Guard is typically paired with PortFast/edge configuration. Enabling BPDU Guard on a legitimate uplink that must receive BPDUs will take that uplink down—apply it to host-facing ports, not distribution uplinks. Also know how your platform recovers err-disabled ports (manual shutdown/no shutdown versus errdisable recovery).

Operational check: enable spanning-tree portfast and bpduguard on classroom access interfaces, connect a test switch that sends BPDUs in a maintenance window, confirm the port err-disables, review logging, and document the recovery procedure for campus staff.