Campus wall ports already forward immediately for PCs. A switch plugged into one of those jacks must be kept out of spanning tree. Which control should be added on those ports?
Select an answer to reveal the explanation.
Short Explanation
The wall jack is a door for a PC, and you do not want a surprise switch to walk in and join the spanning-tree conversation. BPDU guard shuts that door if it hears a bridge PDU. Electing every jack as root, turning off spanning tree, or making the jack a trunk invites the loop you are trying to refuse.
Full Explanation
BPDU guard is the companion to an edge port. The port is allowed to forward immediately because it should face an end host, and if it receives a bridge PDU from a switch someone plugged in, the guard disables the port instead of letting that switch join spanning tree. The campus already forwards immediately on those wall ports and wants a plugged-in switch kept out, so BPDU guard is the control to add. Making each wall port the root would pull the topology toward a PC jack and does not block a rogue switch. Disabling spanning tree removes loop protection on the access switches, which is the opposite of keeping an unexpected switch out. Converting the wall ports to trunks expects tagged switches and users, and a trunk does not reject a switch that a user plugs in. Exam caveat: the guard disables the port until someone recovers it, so a real PC that never sends bridge PDUs is unaffected, and a legitimate switch needs a different port. Operational check: plug a test switch into a guarded jack, confirm the port disables, then recover it and confirm a PC still forwards.