The election, in brief
Cisco’s v1.1 topics give this area two topics: Layer 2 and Layer 3 EtherChannel with the Link Aggregation Control Protocol (LACP, 2.4), and Rapid PVST+ (2.5), which covers the root bridge, port roles and states, PortFast and the guard features.
Every switch starts by claiming to be root, and the lowest bridge ID wins. The ID compares the priority first (32768 by default, adjustable only in steps of 4096) plus the VLAN number as the extended system ID, then the MAC address as the tiebreaker. An untouched switch in VLAN 20 advertises 32788, so a default network elects whichever switch has the lowest MAC address, which is rarely the one you would pick.
Each non-root switch then chooses a root port and each segment a designated port; what is left becomes alternate or backup and discards. The tie-breakers and every role are mapped on STP root bridge and port roles.
To choose the root yourself, lower that switch’s priority for the VLAN, with a value or with the spanning-tree vlan 20 root primary macro; root secondary prepares the backup. spanning-tree mode rapid-pvst selects the protocol.
Default port costs, short method
| Link speed | Port cost |
|---|---|
| 10 Mb/s | 100 |
| 100 Mb/s | 19 |
| 1 Gb/s | 4 |
| 10 Gb/s | 2 |
The long method (802.1t) uses larger values, 20,000 for 1 Gb/s. show spanning-tree summary states which method a switch uses, and every switch in one network should use the same one.
Reading the result for one VLAN
Trimmed show spanning-tree vlan 20 on a non-root access switch (lab values)
SW2#show spanning-tree vlan 20VLAN0020 Spanning tree enabled protocol rstp Root ID Priority 24596 Address 0019.e86a.1f80 Cost 4 Port 25 (GigabitEthernet1/0/25) Bridge ID Priority 32788 (priority 32768 sys-id-ext 20) Address 0019.e86a.4c00Interface Role Sts Cost Prio.Nbr Type------------------- ---- --- --------- -------- ------------------Gi1/0/1 Desg FWD 4 128.1 P2p EdgeGi1/0/25 Root FWD 4 128.25 P2pGi1/0/26 Altn BLK 4 128.26 P2pThe root’s priority, 24596, is 24576 plus VLAN 20. Cost 4 is one gigabit hop to the root. Gi1/0/26 is an alternate port, a second path to the root that lost on the tie-breakers; Rapid PVST+ holds it discarding and IOS prints that as BLK. Gi1/0/1 is an edge port facing a host.
RSTP states and link types
- Discarding
- Forwards no user frames and learns no addresses. RSTP folds the older blocking, listening and disabled states of 802.1D into this one.
- Learning
- Still forwards no user frames, but fills the MAC address table so the port does not flood when it opens.
- Forwarding
- Sends and receives user frames. Root and designated ports end here.
- Edge
- A port facing an end device, set with PortFast. It forwards at once and loses its edge status the moment it hears a BPDU.
- Point-to-point
- A full-duplex link to one other switch. RSTP can move it to forwarding through a quick proposal and agreement instead of timers.
- Shared
- A half-duplex link that may reach several bridges, so RSTP falls back to slower timer-based transitions.
Edge ports and the guards
PortFast belongs on ports that face end devices and nowhere else. Without it, a host that asks for a DHCP lease the moment its link comes up can time out while the port is still working through learning.
The guard features each watch for a different BPDU (bridge protocol data unit) event and each leaves its own trace in the log: one reacts to any BPDU at all on a host port, one to a superior BPDU that would move the root, one to BPDUs that stop arriving on a port that used to hear them. Match the event to the feature first and the command second. BPDU filter, which stops a port from sending and processing BPDUs, is in v1.1 and drops out of v2.0.
EtherChannel: what has to match
LACP (IEEE 802.1AX, formerly 802.3ad) is the negotiation protocol both blueprints name. Members must agree on speed, duplex and switchport settings (the access VLAN, or trunk mode with its allowed and native VLANs); a member that disagrees is left out of the bundle. You configure the physical interfaces with channel-group 1 mode active or mode passive, the switch creates interface Port-channel1, and later changes go on that interface.
A Layer 3 EtherChannel is the same bundle with the members and the port-channel set to no switchport and the IP address on the port-channel. It is a routed link, so spanning tree no longer runs over it. PAgP, Cisco’s older protocol, is named in neither blueprint; the mode pairs of both protocols are compared on LACP vs PAgP modes.
A wireless LAN controller bundles its uplinks too, as a LAG, but on Cisco’s AireOS controllers the bundle is static: the controller negotiates neither LACP nor PAgP, so the switch side uses mode on. The controller side continues in the wireless LANs study area. The frame-by-frame view of the links underneath is on switching, VLANs and trunks.
Frames: the tree and the bundle
Root election, edge ports, the guards and LACP bundles. Each note names the BPDU or the mode that decided the outcome; a filtered run sits on the practice test for STP and EtherChannel.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 015 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 015
What command would you use to verify the spanning tree status of all VLANs on a switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
display is other vendors’ syntax; Cisco IOS uses show.
Note on B
show stp is not an IOS command; the keyword is spelled out as spanning-tree.
Note on C
Correct: show spanning-tree prints each VLAN’s instance with the root bridge, the local bridge ID, and every port’s role, state and cost.
Note on D
show spanning-tree takes no status keyword; the plain command already shows the state of every VLAN.
Best answer: C · why
The ‘show spanning-tree’ command displays the spanning tree status for all VLANs configured on the switch. It shows information such as the root bridge, port states, and path costs for each VLAN’s spanning tree instance.
- Frame 002 of 015
Which command would you use to verify the EtherChannel load-balancing method on a Cisco switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
LACP has no load-balance show command; the hashing method belongs to EtherChannel, not to the negotiation protocol.
Note on B
show etherchannel distribution is not an IOS command.
Note on C
Correct: show etherchannel load-balance shows the hash method in use, such as src-mac, src-dst-ip or src-dst-mac.
Note on D
show port-channel distribution is not valid IOS syntax.
Best answer: C · why
The ‘show etherchannel load-balance’ command displays the current EtherChannel load-balancing method configured on the switch, such as src-mac, dst-mac, src-ip, dst-ip, or combinations of these.
- Frame 003 of 015
What is the maximum number of physical interfaces that can be combined in a single EtherChannel bundle using LACP?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: LACP can include up to 16 ports in one bundle, with 8 active and the other 8 in hot standby.
Note on B
Four is well below the limit; bundles commonly use 2, 4 or 8 active links.
Note on C
Eight is the number of active links, but LACP can hold up to 8 more ports in standby.
Note on D
32 members with 16 active goes beyond what LACP allows on Catalyst switches.
Best answer: A · why
With LACP (Link Aggregation Control Protocol), up to 16 physical interfaces can be configured in a single EtherChannel bundle. However, only 8 ports can be active at one time, with the remaining ports in standby mode, ready to become active if an active port fails.
- Frame 004 of 015Choose 2
Two switches are joined by four links whose speed, duplex and trunk settings match. Which two pairs of channel-group modes bring up an LACP EtherChannel? (Choose two.)
Choose 2 options, then Check answer. Open the note under any option to see why.
Note on A
Passive ports only answer LACPDUs and never send them first, so two passive ends wait for each other and no bundle forms.
Note on B
Correct. Both ends send LACPDUs, so they negotiate the bundle with each other.
Note on C
Correct. The active end sends LACPDUs and the passive end answers them, which is enough to negotiate the bundle.
Note on D
Mode on runs no LACP at all, so the active end never gets an LACPDU back. Mode on needs mode on at the other end.
Best answers: B and C · why
LACP (IEEE 802.1AX) has two negotiating modes. Active sends LACPDUs and starts negotiation; passive only replies. A bundle forms when at least one end is active, so active with active and active with passive both work, while passive with passive does not. Mode on is a static bundle with no negotiation protocol and must be used at both ends; mixing it with an LACP mode fails.
- Frame 005 of 015
Redundant links between switches can let frames loop endlessly and cause a broadcast storm. Which protocol do switches run to block redundant paths and prevent these loops?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
LLDP advertises device identity and capabilities to neighbors. It discovers links but never blocks a port.
Note on B
VRRP provides a redundant default gateway for hosts. It works at Layer 3 and has no effect on Layer 2 loops.
Note on C
ARP maps IPv4 addresses to MAC addresses on a LAN. It does not control whether a switch port forwards.
Note on D
Correct. Spanning tree elects a root bridge and puts redundant ports in a blocking or discarding state, leaving one loop-free path.
Best answer: D · why
Ethernet frames have no time-to-live, so a broadcast sent into a loop of switches circulates and multiplies until the links saturate. Spanning tree (IEEE 802.1D, and RSTP or Rapid PVST+ on current Cisco switches) prevents this: the switches elect a root bridge, pick one best path toward it, and hold every redundant port in a blocking or discarding state. If an active link fails, a blocked port can take over.
- Frame 006 of 015
What feature of EtherChannel allows traffic to be distributed across multiple physical links based on source and destination IP addresses?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Redundancy means the bundle survives a member link failure; it does not decide which link each flow uses.
Note on B
Traffic shaping buffers traffic to hold a rate; it does not spread flows across member links.
Note on C
Flow control uses pause frames to slow a sender; it has nothing to do with choosing a member link.
Note on D
Correct: EtherChannel load balancing hashes header fields, such as source and destination IP, to pick a member link for each flow.
Best answer: D · why
Load balancing is the feature of EtherChannel that allows traffic to be distributed across multiple physical links based on various criteria, including source and destination IP addresses. This helps to utilize all available bandwidth in the EtherChannel bundle efficiently.
- Frame 007 of 015
A switch port has PortFast and BPDU Guard enabled. Which state does the interface enter as soon as it receives a BPDU?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: BPDU Guard puts the port in the err-disabled state as soon as a BPDU arrives, and it stays down until it is recovered.
Note on B
Root-inconsistent is the state Root Guard uses when a superior BPDU arrives; BPDU Guard shuts the port down instead.
Note on C
Learning is a transitional STP state; BPDU Guard does not move the port through it.
Note on D
Listening is a classic 802.1D transitional state; BPDU Guard shuts the port down rather than restarting STP on it.
Best answer: A · why
BPDU Guard protects edge (PortFast) ports, which should face only hosts. If such a port receives any BPDU, the switch places it in the err-disabled state and shuts it down. It comes back only after shutdown and no shutdown or through errdisable recovery. Root-inconsistent is what Root Guard does with a superior BPDU, and listening and learning are normal spanning tree states.
- Frame 008 of 015
In a network utilizing Rapid PVST+, which feature is critical to prevent bridging loops when BPDUs are not received on an interface?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
PortFast only speeds up edge ports; it does nothing when BPDUs stop on a link between switches.
Note on B
Root Guard reacts to superior BPDUs that try to move the root; it does not act when BPDUs go missing.
Note on C
Correct: Loop Guard puts a non-designated port in the loop-inconsistent (blocking) state when its BPDUs stop, instead of letting it go to forwarding.
Note on D
BPDU Filter stops sending and processing BPDUs, which can create a loop instead of preventing one.
Best answer: C · why
If a root or alternate port stops receiving BPDUs, for example because of a one-way link, spanning tree would age out the information and move the port to forwarding, creating a loop. Loop Guard keeps that port blocked in the loop-inconsistent state until BPDUs return. Root Guard deals with superior BPDUs, PortFast with edge ports, and BPDU Filter suppresses BPDUs.
- Frame 009 of 015
Which protocol can be used to aggregate multiple physical links into a single logical link to increase bandwidth and provide redundancy in a network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: LACP (IEEE 802.1AX) negotiates an EtherChannel that bundles physical links into one logical link for more bandwidth and redundancy.
Note on B
STP keeps redundant links loop-free by blocking some of them; it does not combine them.
Note on C
RADIUS is an AAA protocol for authenticating users and devices; it has nothing to do with link bundling.
Note on D
PortFast lets edge ports skip spanning tree’s waiting states; it does not bundle links.
Best answer: A · why
LACP, defined in IEEE 802.1AX, negotiates an EtherChannel between two devices so several physical links act as one logical link. Traffic is spread over the members, and the bundle survives a member failure. STP blocks redundant links rather than combining them, RADIUS handles authentication, and PortFast speeds up edge ports.
- Frame 010 of 015
Which command would you use to enable PortFast on an access port in Rapid PVST+?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: spanning-tree portfast on the interface makes the access port an edge port that goes straight to forwarding.
Note on B
IOS treats portfast as one word, so spanning-tree port fast is rejected.
Note on C
spanning-tree edge-port is not an IOS interface command; Cisco calls the feature PortFast.
Note on D
There is no rapid-portfast keyword; the same spanning-tree portfast command works in Rapid PVST+.
Best answer: A · why
Entered in interface configuration mode, spanning-tree portfast makes an access port an edge port, so it moves straight to forwarding instead of waiting through the discarding and learning stages. It belongs only on ports facing end devices, usually together with BPDU Guard. Newer IOS releases also accept the form spanning-tree portfast edge.
- Frame 011 of 015
What feature in Rapid PVST+ allows edge ports to immediately transition to the forwarding state?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Root Guard stops a port from accepting a superior BPDU; it does not speed up edge ports.
Note on B
Correct: PortFast marks a port as an edge port, so it goes to forwarding at once instead of waiting through the normal STP stages.
Note on C
UDLD detects one-way links; it has nothing to do with how fast a port starts forwarding.
Note on D
BPDU Guard err-disables a PortFast port that receives a BPDU; it protects edge ports but does not make them forward sooner.
Best answer: B · why
PortFast makes a port an edge port. In Rapid PVST+ an edge port goes to forwarding as soon as it comes up instead of waiting in the discarding and learning states, so a host gets connectivity at once. It is meant only for ports facing end devices. Root Guard, BPDU Guard and UDLD are protection features, not speed features.
- Frame 012 of 015
How frequently do switches send Bridge Protocol Data Units (BPDUs) in a typical spanning tree environment?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
One second is shorter than the default; the STP hello time is 2 seconds.
Note on B
Ten seconds is not an STP default; the defaults are hello 2, forward delay 15 and max age 20 seconds.
Note on C
Correct: the default hello time is 2 seconds, so the root bridge, and in RSTP every bridge, sends BPDUs every 2 seconds.
Note on D
Five seconds is not a default STP timer; the hello interval is 2 seconds.
Best answer: C · why
The default spanning tree hello time is 2 seconds. In 802.1D the root bridge originates BPDUs at that interval and the other switches relay them; in Rapid STP every bridge sends its own BPDUs every 2 seconds. The other defaults are a max age of 20 seconds and a forward delay of 15 seconds.
- Frame 013 of 015
Which feature prevents a switch port from receiving any BPDUs, shutting down the port if a BPDU is received?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: BPDU Guard err-disables a port the moment any BPDU arrives on it, which keeps unauthorized switches off edge ports.
Note on B
Root Guard blocks a port only when it receives a superior BPDU and recovers on its own; ordinary BPDUs are allowed.
Note on C
Loop Guard acts when BPDUs stop arriving, the opposite situation.
Note on D
Storm control limits broadcast, multicast or unicast floods by rate; it does not look for BPDUs.
Best answer: A · why
BPDU Guard is used on PortFast edge ports. If any BPDU arrives on such a port, the switch err-disables it, so a switch plugged into a user port cannot join the topology. Root Guard reacts only to superior BPDUs, Loop Guard to missing BPDUs, and storm control to traffic floods.
- Frame 014 of 015
What command is used to verify the operational status of an EtherChannel bundle?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
show lacp neighbor shows LACP partner details per port; it does not summarize the state of the bundle.
Note on B
Correct: show etherchannel summary lists each port-channel and its members with flags such as SU (Layer 2, in use) and P (bundled).
Note on C
show channel-group is not an IOS show command; channel-group is the interface command that adds a port to a bundle.
Note on D
show interface port-channel shows the logical interface’s line status and counters, not which members are bundled.
Best answer: B · why
The ‘show etherchannel summary’ command displays a summary of all EtherChannel interfaces on the switch, including their operational status, protocol, ports in the channel, and ports that are standby or down.
- Frame 015 of 015
On a distribution switch, Gi1/0/24 connects to an access switch. Someone attaches a lab switch with bridge priority 0 to that access switch. Gi1/0/24 stops forwarding, a spanning-tree check lists it as root-inconsistent, and it forwards again by itself once the lab switch is removed. Which feature is enabled on Gi1/0/24?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
BPDU guard err-disables the port on any BPDU, and an err-disabled port needs manual or timed recovery. It does not set root-inconsistent.
Note on B
Loop guard acts when expected BPDUs stop arriving and marks the port loop-inconsistent. Here superior BPDUs started arriving instead.
Note on C
Correct. Root guard blocks a designated port that receives a superior BPDU, marks it root-inconsistent and recovers once those BPDUs stop.
Note on D
BPDU filter would make the port ignore BPDUs entirely, so it would never react to the lab switch, and it has no inconsistent state.
Best answer: C · why
Root guard is enabled on designated ports where the root bridge should never appear, typically distribution ports facing access switches. If such a port receives a superior BPDU, as from a rogue switch with priority 0, the switch does not accept the new root. It puts the port in the root-inconsistent state, which forwards no traffic, and returns it to forwarding automatically when the superior BPDUs stop. BPDU guard instead err-disables an edge port on any BPDU. Loop guard reacts to missing BPDUs with a loop-inconsistent state. Sources: Cisco’s Root Guard and Loop Guard documents.
Concepts in this study area
- STP root bridge and rolesBridge ID, root path cost and the tie-breakers behind every port role.
- LACP vs PAgP modesActive, passive, desirable, auto and on: the pairs that bundle.