Parks and Recreation places the STP root on distribution and wants designated ports toward wiring closets to refuse a superior BPDU from a downstream switch trying to become root. Which feature addresses that goal?

Root Guard is designed for designated ports where the Parks and Recreation distribution layer should remain the STP root path authority toward wiring closets. If a downstream switch advertises a superior BPDU and tries to become root through that link, Root Guard keeps the port from becoming a root port and places it in a root-inconsistent state until the superior BPDUs cease. That protects the planned root placement without requiring the port to be a pure edge port that never hears BPDUs.

BPDU Guard is the wrong primary tool here because it err-disables a port that hears BPDUs; closet uplinks legitimately exchange BPDUs with access switches, so BPDU Guard would punish normal operation. UDLD aggressive mode detects unidirectional fiber/copper faults; it is valuable but does not enforce STP root placement and is not a substitute for Root Guard. Static ON EtherChannel on every access port neither blocks superior BPDUs from changing the root nor is an appropriate blanket on host/access ports.

Exam caveat: Root Guard and BPDU Guard solve different problems—root identity versus unexpected BPDUs on edge ports. Using the wrong feature is a common ENCOR distractor. Root-inconsistent is not the same as err-disabled; traffic is blocked on that port until the superior BPDU condition clears.

Operational check: place Root Guard on distribution designated ports toward closets, lower a lab access-switch priority to simulate a superior bridge ID, confirm the guarded port goes root-inconsistent rather than accepting the new root, restore priorities, and verify forwarding returns without crowning the closet switch.