AP Networking Exam PrepBuild • Secure • Troubleshoot • Verify
Loop Prevention • Phase 7

Spanning Tree, Switching Loops & Broadcast Storms Practice Test

Practice 75 spanning-tree questions: root elections, path costs, RSTP roles, BPDU guards, MAC flaps, broadcast storms, hidden bridges, and verified recovery.

Published and updated October 25, 2026 · Free student and teacher resource · 25 Easy + 25 Medium + 25 Hard
Start the testRead the loop-troubleshooting guide

A blocked path can be the protection that keeps the network working

Learn to distinguish a healthy alternate path, an unexpected root, a guard event, a high-rate endpoint, and a real Layer 2 forwarding cycle. These 75 original scenarios ask you to read the correct instance, compare path costs, interpret control evidence, and verify both service recovery and required redundancy.

Easy questions isolate one mechanism. Medium questions combine topology and observations. Hard questions introduce hidden bridges, asymmetric control visibility, capture duplication, partial repairs, and conflicting outputs. These are independent instructional questions, not official Cisco or College Board exam items. Cisco-specific feature behavior is identified in the questions; verify your platform before applying a configuration.

Start the interactive test · Read the troubleshooting guide · Choose another topic

Take the spanning-tree and switching-loop practice test

Choose one answer to receive immediate feedback. Your first selection is scored; read the explanation before moving on. Use keyboard Tab to reach controls and arrow keys within the answer group. You can use these as untimed diagnostic practice, pausing to write your reasoning.

Changing difficulty or restarting clears the current attempt. Download your log first if you want to keep it.

Back to Top of Practice Test

Read all 75 prompts and choices

Open a prompt to inspect its choices. Its reference answer and explanation stay hidden until you select an answer for that item in the interactive test. Reference IDs stay fixed for classroom discussion and correction reports. Restarting or switching difficulty clears the current attempt and hides the revealed reference answers. Download your log first if you want to keep it.

Easy question library · 25 questions

Easy 1. What does spanning tree primarily prevent in a bridged Ethernet topology?
  1. A cycle of active Layer 2 forwarding paths
  2. Duplicate IP addresses assigned by DHCP
  3. A routing table containing two default routes
  4. A server sending too many legitimate broadcasts
Easy 2. In one spanning-tree instance, A has bridge priority 8192 and B has 16384. All other relevant priority components are equal. Which wins the root election?
  1. B, because the highest priority number wins
  2. Whichever has the lowest management IP address
  3. A, with the lower priority component
  4. Whichever has the largest number of access ports
Easy 3. Two switches have equal priority components in the same STP instance. Their bridge MAC addresses end in 0010 and 0020, with identical preceding digits. Which is preferred as root?
  1. The switch with the larger IP subnet
  2. The switch that last renewed its DHCP lease
  3. The switch whose bridge MAC ends in 0020
  4. The switch whose bridge MAC ends in 0010
Easy 4. For a non-root switch in a converged spanning-tree instance, what does its root port provide?
  1. An access port reserved for the network administrator
  2. Its selected best path toward the root bridge
  3. The port with the lowest printed interface number in all cases
  4. The only port allowed to learn any source MAC
Easy 5. How many root ports does the root bridge itself have in that spanning-tree instance?
  1. Zero
  2. One for every directly attached switch
  3. Exactly two for redundancy
  4. One for each VLAN-tagged frame
Easy 6. An RSTP alternate port is discarding and an end-to-end transfer works over the selected path. What is the most likely interpretation?
  1. The alternate port must have a broken physical cable
  2. The network has lost all protection against loops
  3. The switch has rejected every BPDU it received
  4. A healthy redundant path is discarding
Easy 7. What information do spanning-tree BPDUs help switches exchange?
  1. Topology information for forwarding-role selection
  2. Application file sizes used for TCP segmentation
  3. DHCP lease durations for client addresses
  4. The server certificate used for HTTPS validation
Easy 8. Which states are used by RSTP?
  1. Blocking, listening, learning, forwarding, and disabled as five distinct RSTP states
  2. Discover, offer, request, and acknowledge
  3. Established, closing, and time-wait
  4. Discarding, learning, and forwarding
Easy 9. In the STP learning state, which behavior is expected?
  1. Forward user traffic without learning source addresses
  2. Learn source MACs without forwarding user frames
  3. Route packets using the destination IP prefix
  4. Ignore BPDUs until the first user frame arrives
Easy 10. Why does an IP TTL not normally stop a frame circulating through an Ethernet switching loop?
  1. Each switch resets the IP TTL to 255
  2. Layer 2 forwarding leaves the enclosed IP TTL unchanged
  3. Ethernet broadcast frames always carry TCP rather than IP
  4. Every switch discards the IP header before forwarding
Easy 11. A switch learns an unknown source MAC from a received frame. Which field and location establish the new table entry?
  1. Its source MAC, ingress port, and VLAN
  2. The root bridge’s MAC and the highest-speed uplink
  3. The destination IP address and DNS resolver port
  4. The frame’s destination MAC and every egress port
Easy 12. What normally happens to an unknown-unicast frame in a VLAN?
  1. It is discarded until a DNS query identifies the destination
  2. It is sent only to the default gateway regardless of destination
  3. Flood it within the VLAN, excluding ingress
  4. It is changed into an Ethernet broadcast frame
Easy 13. Which statement about a broadcast spike is defensible?
  1. It proves the root bridge has the wrong IP address
  2. It can be repaired only by disabling spanning tree
  3. It is a symptom that needs a cause investigation
  4. It proves an active switching loop by itself
Easy 14. What is Cisco PortFast intended to improve on a genuine endpoint-facing edge port?
  1. The maximum TCP payload for all clients
  2. The endpoint port’s transition to forwarding
  3. The bandwidth of every uplink in the VLAN
  4. The root bridge’s priority during election
Easy 15. A Cisco interface with BPDU Guard explicitly enabled receives a BPDU. What action is expected?
  1. The interface becomes error-disabled
  2. The switch raises the sender’s bridge priority
  3. The interface automatically becomes the new root bridge
  4. The received BPDU is silently treated as an ARP reply
Easy 16. On a Cisco designated boundary port, Root Guard receives a superior BPDU. What condition can result?
  1. Automatic election of the attached switch as root
  2. A new TCP zero-window advertisement
  3. A change to the management IP subnet mask
  4. Root-inconsistent blocking
Easy 17. What failure is Loop Guard designed to help prevent on an eligible non-designated port?
  1. Unsafe forwarding after expected BPDUs disappear
  2. A DHCP server offering an address from the wrong subnet
  3. An endpoint receiving two valid DNS responses
  4. A router selecting a longer IP prefix than expected
Easy 18. What does storm control do most directly?
  1. Compute a new spanning tree from the cable diagram
  2. Select the switch with the lowest bridge ID
  3. Guarantee that no Ethernet loop physically exists
  4. Threshold-based suppression of selected traffic
Easy 19. Two separately configured switch links form redundant paths with no aggregation. Should an operator assume both will forward for the same STP instance?
  1. No; spanning tree may keep one path non-forwarding
  2. Yes; two cables always form a port-channel automatically
  3. Yes; STP shares traffic equally over all redundant links
  4. No; STP requires physically removing every spare cable
Easy 20. When a correctly formed EtherChannel is presented to spanning tree, how is it normally treated?
  1. As a reason to disable spanning tree on the VLAN
  2. As one logical spanning-tree port
  3. As a routed link regardless of its configuration
  4. As a separate root bridge for each member cable
Easy 21. A MAC address moves once during a documented failover and then stays stable. What does that alone establish?
  1. A permanent duplicate-IP conflict
  2. A guarantee that every VLAN lost its root bridge
  3. A location change that may be legitimate
  4. A sustained broadcast storm beyond doubt
Easy 22. In per-VLAN spanning tree, can one physical trunk have different roles for two VLANs?
  1. Yes; but only if both VLANs have identical root paths
  2. No; roles are chosen solely from the trunk’s IP address
  3. Yes; the per-VLAN trees can select different roles
  4. No; one cable always has a single role for every VLAN
Easy 23. A Cisco log reports BPDU Guard as the cause of errdisable. What should be checked before re-enabling the port?
  1. Only whether the attached laptop can resolve a hostname
  2. What attachment or bridging path delivered the BPDU
  3. Only whether the root has the lowest management IP
  4. Whether the interface description contains the word access
Easy 24. Which post-repair observation is strongest for the original storm incident?
  1. The switch’s management name is unchanged
  2. An unrelated server answers one small ping
  3. A link LED turns green on one interface
  4. Stable roles and traffic rates, with affected service restored
Easy 25. Why must a spanning-tree troubleshooting note identify the VLAN or instance?
  1. A VLAN number determines the DNS search suffix
  2. Bridge IDs are selected separately for each TCP socket
  3. Instances can have different roots and port roles
  4. Only one VLAN is ever carried on a trunk

Medium question library · 25 questions

Medium 1. A switch hears the same root through two ports. Port X receives advertised cost 8 and has local cost 4; Y receives advertised cost 4 and has local cost 19. No earlier comparison differs. Which root path is preferred?
  1. X, with total cost 12
  2. Y, because its advertised cost is lower
  3. X, because root path cost ignores the local port cost
  4. Y, with total cost 23
Medium 2. Two ports offer the same root ID and total root path cost. One BPDU comes from a lower sender bridge ID. No other earlier criterion differs. Which path wins?
  1. The receiver’s lower local port ID, even when its sender bridge ID is worse
  2. Both paths as equal-cost STP multipath
  3. The one advertised by the lower sender bridge ID
  4. The higher sender bridge ID
Medium 3. Two parallel links to the same upstream bridge offer equal root ID and total cost. The sender bridge ID is identical, but sender port IDs differ. Which comparison comes next?
  1. The port that last received user data
  2. The lower sender port ID
  3. The less-utilized member link
  4. The lower local receiving-port ID first
Medium 4. On a shared segment in one instance, A and B advertise the same root. A’s root path cost is 12 and B’s is 20. Which side is preferred as designated, with no earlier difference?
  1. A’s side, because it advertises the lower root cost
  2. The side with lower local port cost only
  3. B, because higher root cost is preferred
  4. Both, because their root IDs match
Medium 5. A triangle of switches has one alternate/discarding port and no loss or storm. A student proposes enabling all three sides for the same instance to use every cable. What is the issue?
  1. STP blocks a path only after detecting a duplicate frame
  2. It would recreate a Layer 2 forwarding cycle
  3. All three sides must forward to provide redundancy
  4. An alternate port cannot process BPDUs
Medium 6. A trunk forwards VLAN 10 but its VLAN 20 instance reports alternate/discarding. VLAN 20 reaches the root over another path. What is supported?
  1. The alternate role proves VLAN 20 is excluded
  2. VLAN 10’s forwarding role must be copied to VLAN 20 because both use the same physical cable
  3. VLAN 20 cannot have a working path elsewhere
  4. Different per-VLAN roles may be healthy in this topology
Medium 7. A root-inconsistent port also shows a received superior root advertisement from an unapproved downstream switch. What is the narrow next action?
  1. Treat the received superior BPDU as a missing BPDU
  2. Check the downstream root claim against the design
  3. Make the downstream root claim still more preferred
  4. Remove Root Guard to accept the superior root
Medium 8. A previously alternate port reports loop-inconsistent after expected BPDUs stop, while physical link status remains up. What should be investigated?
  1. Treat every inconsistent state as a superior-root event
  2. A physically unplugged cable is certain
  3. Force designated forwarding because BPDUs are absent
  4. The missing control traffic and possible one-way link behavior
Medium 9. A host-facing PortFast port takes longer to become usable after an unmanaged bridge is attached. BPDUs now arrive and no BPDU Guard is configured. What changed?
  1. The delay alone proves BPDU Guard is enabled
  2. PortFast permanently disabled STP on that port
  3. The attachment no longer fits the assumed edge behavior
  4. The newest BPDU sender must become root
Medium 10. A student joins two wall outlets with a patch cable. Many source MACs then alternate between two uplinks and broadcast rates jump. Which hypothesis fits the combined evidence best?
  1. A root election directly raising endpoint transmit rates
  2. A Layer 2 return path through the new patch
  3. A one-time move during an orderly failover
  4. A high-rate source with a stable learned location
Medium 11. One printer emits heavy ARP traffic. Its MAC stays on one access port, STP roles are stable, and no return path is found. What should be examined next?
  1. Force an alternate path to forward more copies
  2. The stable printer MAC proves frame recirculation
  3. Move the root to stop the printer generating ARP
  4. The printer’s traffic generation before declaring a switching loop
Medium 12. A topology-change counter reads 800, but the last change was 18 days ago and current traffic is stable. What is missing from a claim of an active STP failure?
  1. The cumulative total proves a current change rate
  2. One passing ping disproves every historical impact
  3. An increase correlated with this incident
  4. The counter must be cleared before comparing snapshots
Medium 13. Unknown-unicast flooding rises during repeated topology changes, but broadcast rates remain normal. Which mechanism can explain this?
  1. The switch converts all learned unicasts into ARP requests
  2. Every unknown unicast proves a physical loop
  3. Topology changes change the Ethernet destination to broadcast
  4. MAC-table churn makes destinations temporarily unknown
Medium 14. Two switches are intended to use a port-channel. Operational output shows one bundled member and one standalone forwarding link. What should be checked?
  1. Bundle membership and the standalone link’s STP state
  2. Remove STP from the standalone link
  3. Matching interface descriptions establish a bundle even when operational membership differs
  4. The bundled neighbor makes the standalone link safe
Medium 15. After a fiber fault, one endpoint still reports link up but stops receiving BPDUs. Which companion mechanism can help investigate or detect one-way link conditions on supported Cisco equipment?
  1. BPDU Guard on the BPDU-receiving uplink
  2. UDLD on supported equipment
  3. Root Guard for all one-way-link faults
  4. Storm control as proof of bidirectional delivery
Medium 16. A team lowers a switch’s bridge-priority number to make it less likely to become root. Why does this contradict STP election rules?
  1. STP prefers the highest bridge-priority number
  2. Lower values make the bridge ID more preferred
  3. Bridge priority affects designated roles only
  4. A lower MAC always beats a worse priority
Medium 17. Broadcast suppression restores usable bandwidth, but the same MACs continue flapping across a confirmed forwarding cycle. What is the repair status?
  1. The remaining flaps prove only a stale DNS cache
  2. Spanning tree has necessarily converged to a safe topology
  3. The source MAC addresses have all been changed successfully
  4. Containment helped; the loop remains
Medium 18. A switch shows the expected root ID. A redundant port was manually forced into forwarding and frame copies circulate. Which additional condition is necessary to rule out this forwarding fault?
  1. A loop-free operational forwarding topology
  2. No redundant interface remains discarding
  3. The root always has the fastest physical links
  4. Every repeated frame was independently generated
Medium 19. A Catalyst port is error-disabled. No reason has been collected. Why is immediately blaming BPDU Guard premature?
  1. Errdisable is always just an alternate STP role
  2. BPDU Guard can never disable an interface
  3. The root bridge always reports every errdisable cause remotely
  4. Several protection or fault causes can produce errdisable
Medium 20. A blocked inter-switch path is restored after a fault. Which test addresses the redundancy requirement?
  1. Failover and recovery of the affected VLANs
  2. All independent paths forwarding simultaneously
  3. No role or root change during any failure
  4. A normal-state root-ID snapshot only
Medium 21. VLAN 30 cannot traverse one trunk; STP says forwarding, but the trunk’s allowed-VLAN list excludes 30. What should be repaired first?
  1. The receiver’s TCP MSS advertisement
  2. BPDU Guard on every client port in VLAN 10
  3. The intended VLAN carriage on that trunk
  4. The root priority because forwarding must mean root failure
Medium 22. Wireless clients roam and a few MACs move between AP-facing ports without traffic amplification. Which follow-up best distinguishes mobility from a loop?
  1. Disable STP so AP paths cannot change roles
  2. Match moves with roaming and traffic evidence
  3. Use the stable root ID to rule out all loops
  4. Classify every location change as a loop
Medium 23. A newly connected access switch unexpectedly becomes root for one VLAN. Which evidence best explains the election?
  1. Its carried VLAN count as the first election field
  2. Its root-port cost before comparing bridge IDs
  3. Its bridge ID compared with the previous root for that instance
  4. Its management IP against the previous root’s IP
Medium 24. A technician changes STP costs and removes an extra cable together, after which the storm stops. What can be claimed from that experiment?
  1. The cable removal alone is proved irrelevant
  2. The cost change alone is proved to have repaired the loop
  3. The combined change worked; individual causality is unclear
  4. Both changes are proved necessary for all VLANs
Medium 25. Classic STP and RSTP outputs use blocking and discarding respectively for non-forwarding behavior. How should the comparison be made?
  1. Interpret state vocabulary in the actual protocol mode
  2. Read either term as a loss of physical carrier
  3. Use identical transition timers because both protocols have the same loop-prevention purpose
  4. Assume discarding always means a guard violation

Hard question library · 25 questions

Hard 1. A and B advertise the same root. On switch C, the path via A costs 4 locally plus 16 advertised; via B costs 19 locally plus 0 advertised. A has the lower sender bridge ID. Which is preferred?
  1. Via B: total cost 19 versus 20 through A
  2. Via A, because the local cost alone is smaller
  3. Via A, because lower sender bridge ID overrides any path cost
  4. Neither; STP cannot compare paths containing different link costs
Hard 2. Two root-port candidates hear the same root with equal total cost. The higher-numbered local interface hears the lower sender bridge ID. Which candidate wins under these stated conditions?
  1. The less-utilized interface at equal root cost
  2. The higher local port, hearing the lower sender bridge ID
  3. Both, using ordinary STP equal-cost sharing
  4. The lower local interface, without considering the better sender bridge ID
Hard 3. On a shared segment, A advertises root path cost 8 and B advertises 12. A’s port cost onto the segment is 19 and B’s is 4. The root ID is identical. Which side is designated?
  1. Both, because port costs differ
  2. A, advertising the lower root path cost
  3. B, because 12 plus 4 is less than 8 plus 19
  4. B, because the port with lower local cost is always designated
Hard 4. A root-inconsistent boundary blocks after a contractor attaches a low-priority switch. Disconnecting that attachment clears the condition. What should be verified before the contractor reconnects?
  1. Root Guard removed so the superior root can win
  2. Only ordinary broadcast reception while blocked
  3. The attachment policy and intended root placement
  4. An even lower contractor priority to avoid superiority
Hard 5. Loop Guard holds VLAN 40 non-forwarding on a trunk, but VLAN 50 still passes. Expected VLAN 40 BPDUs disappeared after a policy change. Which investigation fits?
  1. Copy VLAN 50’s role into VLAN 40
  2. Per-instance control delivery and filtering on the affected path
  3. Remove Loop Guard based on working VLAN 50 data
  4. Replace the cable because one VLAN implies no carrier
Hard 6. An edge port repeatedly hits BPDU Guard after each automatic recovery. The attached phone has a small downstream bridge connected to a second wall outlet. What is a durable repair?
  1. Recover faster while retaining the same attachment
  2. Remove the unintended bridge path and restore edge policy
  3. Filter the BPDUs and retain the data return path
  4. Change root priority but retain the BPDU source
Hard 7. A team enables interface-level BPDU filtering on both ends of a redundant link to silence warnings. The links then forward and traffic amplifies. What failed?
  1. Filtering performs the same election as STP
  2. The disappearance of BPDU-related warnings proves that the redundant data path is now loop-free
  3. Hidden control traffic prevents the data cycle
  4. BPDU visibility was removed while the data cycle remained
Hard 8. A single high-rate multicast sender overloads a VLAN while STP stays stable. Captures show one ingress copy per packet and no recirculation. What claim is best supported?
  1. High-rate multicast proves frame recirculation
  2. Investigate the source and multicast forwarding; a loop is unproved
  3. Moving the root stops the source’s original frames
  4. Stable STP proves traffic cannot harm applications
Hard 9. Switch A logs a MAC flap on its uplinks, but the actual repeated return path is two switches farther away. Why should A not automatically be named the faulty switch?
  1. The first logger must own the flapping MAC
  2. Only a local fault permits a downstream MAC move
  3. The flap log identifies the local cable creating the loop, even when frames return farther downstream
  4. It is an observation point, not necessarily the origin
Hard 10. A supposed LACP bundle has all members forwarding, but only one side groups them into a channel. MACs flap and the remote side sees separate links. What should the repair target?
  1. Consistent operational aggregation at both ends
  2. Use matching descriptions as operational bundle proof
  3. Keep one-sided bundling and raise traffic thresholds
  4. Disable STP globally to let LACP negotiate
Hard 11. A network is stable with one cable removed, but the service requirement includes surviving either uplink failure. Has the final requirement been met?
  1. Yes; a physically disconnected cable is an active standby path
  2. Yes; any single working link proves both failure cases
  3. No; all physical links must always forward in the same instance
  4. No; the required redundant operation remains untested
Hard 12. A root ID stays constant, but topology-change timestamps repeatedly follow a non-edge access link bouncing. Flooding rises after each event. What should be checked before moving the root?
  1. Move the root because every TC proves bad placement
  2. Clear the total to prevent further flooding
  3. Make every trunk operationally edge
  4. The bouncing link and its actual attachment role
Hard 13. A controller shows an intended primary root, but current on-switch output names another bridge for VLAN 60. The screenshot is from before a change. Which evidence should guide the immediate diagnosis?
  1. The older intended-state screenshot overrides the later root election reported by the switch
  2. Another VLAN’s root ID without instance mapping
  3. A link-up indicator on the intended root
  4. Current instance output compared with the approved design
Hard 14. Two captures contain matching broadcast frames. Their switch mirror sources overlap, and no ingress direction was recorded. Why is that insufficient to prove recirculation?
  1. A stable root makes mirror duplication impossible
  2. Duplicates prove traversal of every diagrammed uplink
  3. The enclosed IP TTL reveals exactly how many ordinary Ethernet switches the frame crossed
  4. Overlapping mirror sources can duplicate an original frame
Hard 15. A VM host bridges two physical NICs into the same VLAN. Both switch ports were documented as ordinary endpoints. New BPDU Guard events and MAC moves appear. What has the inventory missed?
  1. Only physical switch hardware can create a return path
  2. Two host NICs automatically form one safe channel
  3. A software bridge that changes the Layer 2 topology
  4. Two carrier-up links alone make the host root
Hard 16. An RSTP uplink remains in a slower transition after connecting to a legacy STP neighbor. Someone promises that RSTP guarantees the same subsecond recovery on every link. What is wrong?
  1. Legacy interoperability can limit rapid transition
  2. RSTP skips all timers with every legacy neighbor
  3. A faster CPU guarantees rapid legacy agreement
  4. Legacy BPDUs stop all source-MAC learning
Hard 17. All switches claim a stable tree, yet an unmanaged device returns ordinary frames while filtering the BPDUs needed across that path. What does this expose?
  1. A data path exists outside STP’s effective control view
  2. Suppressing BPDUs safely isolates a bridge’s data
  3. Data frames replace the missing root BPDUs
  4. Stable root output proves every data path is visible
Hard 18. One physical uplink carries VLANs mapped to MST instance 1 and another VLAN mapped to instance 2. What must a student inspect before predicting which uplink is blocked?
  1. The mapping and operational roles for each MST instance
  2. One physical-port role for every instance
  3. One independent tree per VLAN without mapping
  4. The highest VLAN number selects the trunk’s role
Hard 19. A team wants the same MST region, but one switch differs in VLAN-to-instance mapping. Which comparison belongs in the next check?
  1. The newest revision alone
  2. The region name alone, because matching names makes every VLAN-to-instance map equivalent
  3. Region name, revision, and VLAN-to-instance mapping
  4. A shared management subnet
Hard 20. A post-repair ping passes, but the capture still shows repeated frame circulation and a limiter is dropping excess copies. What is the correct closure decision?
  1. Remove the limiter first and assume STP will reconstruct the hidden path
  2. Declare the remaining copies a DNS cache artifact
  3. Keep the topology defect open despite partial service recovery
  4. Close the incident because any successful echo proves loop prevention
Hard 21. A loop appears in VLAN 70 only after an allowed-VLAN change activates a redundant path. VLAN 80 stays healthy. Which comparison is most useful?
  1. VLAN 70 carriage, roles, and BPDUs before and after
  2. Uptime without the affected VLAN’s carriage state
  3. VLAN 80’s stable forwarding proves the allowed-VLAN change could not create a cycle for VLAN 70
  4. Carrier alone proves identical VLAN paths
Hard 22. During an authorized failover test, the old root disappears and a planned secondary becomes root. One MAC move occurs, traffic resumes, and the tree stabilizes. How should this be classified?
  1. A routing failure because the secondary has a different bridge MAC
  2. Expected recovery if it meets the measured service criteria
  3. Proof that BPDU Guard must be removed from every edge port
  4. A persistent loop because any root change is a defect
Hard 23. A guard alarm and an application timeout occur at the same second, but the alarm is for VLAN 90 and the timeout flow uses VLAN 20 on another path. What is needed before assigning causality?
  1. Matching time proves a shared VLAN forwarding tree
  2. Any guard alarm, even off the flow’s path
  3. Evidence linking the flow to the affected instance and event
  4. Move the root before identifying the affected instance
Hard 24. A technician proposes BPDU Guard on an inter-switch uplink that must receive BPDUs. The actual objective is preventing a downstream switch from taking root. What policy fits better on the appropriate designated boundary?
  1. PortFast everywhere, because edge status prevents superior advertisements
  2. BPDU Guard, because all expected uplink BPDUs should disable the interface
  3. Root Guard, after verifying the intended topology and platform support
  4. Interface-level BPDU filtering, because hidden BPDUs preserve the same control
Hard 25. A repair report says “fixed the storm” after a suspect patch was removed. Which evidence best completes a defensible handoff?
  1. No drops after raising the storm-control threshold
  2. The final root ID without port or service checks
  3. The removed path, stable counters and roles, and service/failover results
  4. One passing ping with required failover untested

Read the forwarding tree for the affected instance

A cable diagram shows physical possibilities. Spanning tree selects which of those possibilities can forward ordinary Layer 2 traffic without creating a cycle. A spare link that is discarding can therefore be evidence that protection is working. Begin with the affected VLAN or instance, the actual protocol mode, and the intended primary and secondary root. Without that context, “the uplink is blocked” is an incomplete description.

Record three different facts for each relevant port: physical link status, spanning-tree role, and forwarding state. An interface can have carrier, participate in topology control, and still discard user frames. A root-inconsistent state tells a different story from error-disabled. VLAN carriage is another independent check: a port that STP permits to forward does not carry a VLAN that its trunk configuration excludes.

Keep the scope accurate. Per-VLAN spanning tree can give the same trunk different roles for different VLANs. MST maps VLANs to instances, so several VLANs can share one tree. For switches intended to share an MST region, compare the region name, revision, and VLAN-to-instance mapping. Do not assume a region name alone establishes matching configuration. Review switching, VLAN, and Ethernet practice if the distinction between a physical port, a VLAN, and an eligible forwarding path is still unclear.

Work a root-path comparison before using a tie-break

Root election prefers the lowest bridge ID, not the highest numerical priority and not the lowest management IP address. The priority component precedes the MAC-address portion. When comparing switches in the same instance, a lower applicable priority value wins before a MAC tie-break matters. Operational output may include an extended system ID; compare the actual instance context rather than stripping fields you do not recognize.

After identifying the root, a non-root switch selects its best path toward that root. For root-port candidates hearing the same root, add the receiving port cost to the cost advertised by the neighbor. Only when the relevant cost comparison ties do later fields, such as sender bridge ID and sender port ID, decide the result. The receiver’s lowest printed interface number is not a shortcut around those earlier comparisons.

The following invented costs are stated for this exercise; they are not a universal speed-to-cost table. Switch C hears the same root ID on both candidates. All links and paths shown are available.

Swipe horizontally to compare each complete path calculation.

Candidate at CNeighbor advertisesLocal receiving-port costTotal toward the rootDecision
Port toward A16420Not preferred
Port toward B01919Preferred root path

The port toward B wins even if A has the lower sender bridge ID, because the totals do not tie. Designated-port comparison on a segment is a different viewpoint: compare the root information the bridges advertise onto that segment. Do not automatically add each transmitting port’s cost as though you were selecting a receiving root port. Write down whose decision you are making before doing the arithmetic.

Separate a port’s job from its current forwarding state

A root port is a non-root switch’s selected path toward the root. A designated port offers the preferred path information onto its segment. An RSTP alternate role provides another potential path while staying out of active data forwarding. The root bridge itself has no root port. These roles describe relationships in a particular tree; they do not tell you that a cable is damaged.

Classic STP and RSTP use different state vocabulary. Classic STP includes blocking, listening, learning, forwarding, and disabled. RSTP uses discarding, learning, and forwarding. In learning, a switch can populate source-MAC information while withholding ordinary user forwarding. A port that does not forward user frames can still participate in control processing. Treating every non-forwarding state as “dead” leads to repairs that undo loop prevention.

Rapid convergence also needs the right conditions. Edge classification, point-to-point operation, neighbor protocol behavior, and proposal/agreement processing matter. A connection to a legacy neighbor does not promise the same recovery as an appropriate RSTP exchange. Avoid a universal “always under one second” claim. Measure the relevant failure and restoration cases against the service requirement, using the network design and redundancy test to connect topology choices with acceptance criteria.

Apply the Evidence • 120 Missions

Trace the return path before changing a port

A blocked link and a broken link can look similar until students compare the evidence. The Browser Troubleshooting Simulator offers 120 missions for collecting observations, selecting a repair, and checking whether the required task now works.

AP Networking Browser Troubleshooting Simulator
$29.99
120 Missions • 60 Failure Patterns • Offline Copy
BUY NOW — INSTANT ACCESS → See all 120 missions & features

Interpret the protection event before clearing it

PortFast, BPDU Guard, Root Guard, and Loop Guard solve different problems. PortFast improves the initial forwarding transition on a genuine edge attachment. It is not permission to attach an unknown bridge or hide topology messages. BPDU Guard enforces an attachment policy: when explicitly enabled on the interface in these questions, a received BPDU produces a Cisco error-disabled condition. The immediate investigation is what delivered that unexpected control message.

Root Guard belongs at an appropriate designated boundary where a superior downstream root claim should not be accepted. Root-inconsistent blocking can be the correct enforcement of that design. Loop Guard addresses missing expected BPDUs on eligible non-designated paths; it can keep the affected instance non-forwarding rather than allowing silence to become an unsafe forwarding decision. A physically up link can still have a one-way or control-delivery problem. UDLD addresses link-direction behavior on supported equipment and can complement the spanning-tree protection.

Swipe horizontally to compare the event with the next evidence to collect.

Observed eventQuestion to investigateWeak response to avoid
BPDU Guard errdisableWhat unexpected bridge or return path sent the BPDU?Repeatedly recovering the same unsafe attachment
Root-inconsistentWhich superior root claim crossed the intended boundary?Removing the boundary policy to silence the alarm
Loop-inconsistentWhy did expected BPDUs stop for this instance?Forcing forwarding because carrier is still up

Exact defaults, command syntax, automatic recovery, and guard interactions vary by platform and release. Confirm the operating documentation before applying a configuration. An interface labeled “access” is not evidence that its attached device is incapable of bridging.

Mixed Review • Exams and Artifact Labs

Compare loop evidence with its lookalikes

A high traffic counter alone cannot separate a loop, a busy source, and a carriage error. The Complete Exam Prep Vault combines exams, questions, and artifact labs for reviewing the neighboring mechanisms behind a stronger diagnosis.

AP Networking Complete Exam Prep Vault
$39.99
BUY NOW — INSTANT ACCESS → See the Exam Prep Vault contents →
4 Practice Exams • 320 MCQs • 60 Artifact Labs

Distinguish a forwarding loop from a high-rate source

A switching loop supplies an active return path for frames. Flooded traffic can return and be replicated again. Ordinary Layer 2 forwarding does not decrement an enclosed IP TTL, so the Layer 3 routing-loop expiration mechanism does not solve this problem. Ethernet broadcasts and unknown unicasts are useful evidence, but unknown-unicast flooding does not change the destination MAC into a broadcast address.

Build the diagnosis from several observations. A new connection is followed by many source MACs rapidly moving across competing paths; broadcast or flooded traffic rises sharply; captures establish frame return; the affected VLAN has an unintended forwarding cycle. Together these observations support a loop much more strongly than “utilization reached 95%.” A malfunctioning endpoint can generate heavy ARP traffic on one stable port without any return path.

MAC movement also has legitimate explanations. A controlled failover, a wireless roam, or virtual-machine movement can change a learned location. Record whether the moves are brief or sustained, which sources are involved, and whether traffic amplification accompanies them. The switch logging a flap may only be observing a loop elsewhere. Trace the path rather than naming the first device that emitted an alarm. The switching-loop and broadcast-storm explainer develops this mechanism; the test above turns it into specific evidence decisions.

300 Bell Ringers • Teacher Answers

Begin class with one root-path decision

Give students two advertised costs and ask which local port cost still needs to be added. The 300 Bell Ringers pack provides classroom starters and teacher answers for reinforcing the foundations that more complicated topology investigations depend on.

300 AP Networking Bell Ringers
$74.99
BUY NOW — INSTANT ACCESS → See what is included in the 300 Bell Ringers →
Instant Access • Full-Year Teacher Resource

Use a timeline and two observation points

A cumulative topology-change counter needs a time window. Eight hundred changes over a long device uptime cannot establish an active incident. Collect a second snapshot, the last-change time, the reporting port, and the operating mode. Repeated link changes can produce forwarding-table churn and unknown-unicast flooding without a new root election. A stable root ID does not guarantee stable port behavior.

For a capture, document where the mirror or tap observes ingress and egress. Overlapping SPAN sources can record the same original frame more than once. Two matching entries do not prove that a frame traveled around a cycle. Stronger evidence shows a copy returning at a known boundary, in the expected direction, with correlated timing and forwarding information. Check capture drops and mirror capacity before treating a missing observation as proof that a switch discarded the frame.

Useful Cisco IOS-style inspection commands can include show spanning-tree vlan 20 detail, show spanning-tree inconsistentports, show interfaces status err-disabled, show mac address-table, and show etherchannel summary. Availability and output vary. These are examples for reading state, not a universal command sequence for every vendor. Compare the same switch, instance, and incident interval. Use the packet-capture analysis questions when the uncertain step is what an observation actually proves.

Teacher Feedback • Claims and Evidence

Review the claim behind the storm diagnosis

Ask students to distinguish the observation point from the fault location, then write a measurable recovery check. The Artifact Analysis Grading Copilot helps teachers review written evidence and prepare feedback while retaining the final grading decision.

AP Networking Artifact Analysis Grading Copilot
$49.99
8 Criteria • 5 Task Modes • Offline Premium Copy
BUY NOW — INSTANT ACCESS → See the free Copilot preview

Include bundles, software bridges, and VLAN carriage

A correctly formed EtherChannel is normally one logical STP port. Two cables drawn inside the same box are not necessarily a working channel. Check operational membership and compatibility at both ends. A standalone member or one-sided bundling can make the actual topology differ from the diagram. Correct the aggregation design and verify resulting roles before assuming that both physical paths are safely active.

Draw the paths inside endpoints too. A hypervisor, virtual switch, phone attachment, unmanaged desktop switch, or deliberate OS bridge can connect ports that the physical-switch inventory calls endpoints. The label on a wall outlet does not establish its current forwarding role. If a device passes ordinary traffic while suppressing the BPDUs needed along that path, the control protocol may not see the same topology as the data plane.

Check which VLANs the paths actually carry. A change that permits VLAN 70 on a previously unused redundant path can activate a problem for VLAN 70 while VLAN 80 remains healthy. Conversely, an allowed-VLAN omission can cause an outage on an STP-forwarding trunk without any loop. Compare both sides’ VLAN carriage and the applicable tree instead of forcing forwarding to repair an unrelated exclusion. The access-port and trunk mismatch guide helps separate these neighboring failure mechanisms.

Complete Course • 180 Teaching Days

Teach redundancy as a tested behavior

Students need VLAN and forwarding foundations before a multi-instance failover investigation makes sense. The Complete 180-Day Teacher Curriculum provides daily lessons, activities, and simulators for planning that progression and returning to gaps found in practice.

AP Networking Complete 180-Day Teacher Curriculum
$199.99
180 Lessons • 180 Daily Simulators • 36 Teaching Weeks
BUY NOW — INSTANT ACCESS → See 3 free curriculum examples

Restore a safe topology, then prove the service requirement

During an incident, authorized containment may break a suspected return path or limit damaging traffic. Document precisely what it does. Storm control can make a network usable while the cycle remains; removing a cable can restore stability while sacrificing required redundancy. Neither outcome alone proves the finished design. Keep the mechanism, the containment action, and the permanent repair as separate statements.

After correcting the cause, collect the expected root and per-instance roles, normalizing traffic counters, absence of sustained unintended MAC movement, and representative user-service results. Then test required failover and restoration under controlled conditions. A brief expected root change or MAC move during that exercise is not automatically a defect. The acceptance question is whether the tree settles and the required workload recovers within the agreed measurement.

For a written closure, record the affected VLAN, the unintended path, the change, the evidence of stable operation, the measured failure tests, and any remaining limitation. Download the practice log before restarting or changing difficulty. It stays in your browser’s download workflow until you choose to share it; no automatic Canvas submission or teacher dashboard is provided. Choose the next review task from the topic practice library, or connect this work to the networking study guide.

Technical references and a classroom evidence task

The questions and examples are independently written instructional material, not official Cisco or College Board exam items. Check the named platform when applying vendor-specific features. Primary references include Cisco’s guides to RSTP roles and transitions, PortFast and BPDU Guard, Root Guard, Loop Guard and UDLD, MST region behavior, and MAC-flap troubleshooting. Cisco’s STP troubleshooting guide also distinguishes containment, cause repair, and restoring redundancy.

Give students a three-switch drawing, two instance outputs, and a before-and-after counter pair. Ask them to mark the expected forwarding tree, identify one observation that does not prove a loop, propose the next controlled check, and write an acceptance condition that includes the required spare path. Grade how their conclusion follows from the evidence, rather than how many protection-feature names they can list.