A user plugs a consumer switch into a PortFast access port, and it starts sending superior BPDUs in an attempt to become the spanning-tree root. Policy says any edge port that receives a BPDU must be disabled. Which feature enforces that policy?
Select an answer to reveal the explanation.
Short Explanation
An edge port is a doorway for end devices, and end devices don't speak spanning tree. BPDU guard treats any BPDU there as an intruder and slams the door. Watch the root guard trap you'll see: it doesn't disable the port, it just parks it until the superior BPDUs stop.
Full Explanation
PortFast tells the switch that a port connects to an end device, so it moves straight to forwarding. BPDU guard protects that assumption: if a PortFast-enabled port receives any BPDU, the switch places it in the error-disabled state, stopping all traffic until an administrator recovers it or an error-disable recovery timer brings it back. That matches a policy of disabling any edge port that sees a BPDU, and it prevents a rogue switch from influencing the topology. Root guard is meant for designated ports where the root bridge must never appear; when a superior BPDU arrives, it puts the port into a root-inconsistent blocking state rather than error-disabling it, and the port recovers automatically when the superior BPDUs stop. Inferior BPDUs do not trigger it, so it does not meet the any-BPDU requirement. Loop guard prevents alternate or root ports from moving to forwarding when BPDUs stop arriving, protecting against unidirectional links; it addresses the opposite condition. BPDU filter stops sending and processing BPDUs on the port, which hides the rogue switch rather than disabling the port and can create loops. Exam caveat: BPDU guard can be enabled per interface or globally for all PortFast ports. Operational check: connect a test switch to a PortFast port and confirm it shows as error-disabled with a BPDU guard reason in the logs.