CCNA Spanning Tree Protocol: Practice Questions

How to work these questions

1. Write down the bridge ID of every switch as priority first, MAC address second. The lowest priority is the root; compare MAC addresses only between switches that tie on priority. In show spanning-tree the priority includes the VLAN number, so 32778 on VLAN 10 is the default 32768.
2. Mark every port on the root bridge as designated and forwarding. Those ports are settled; do not revisit them.
3. For each non-root switch, add the link costs along every path to the root: 19 for 100 Mb/s, 4 for 1 Gb/s, 2 for 10 Gb/s. The lowest total wins the root port. If two paths tie, the lower sender bridge ID wins, then the lower sender port ID.
4. For each segment that still has no designated port, pick the end whose switch has the lower root path cost; if the costs are equal, the switch with the lower bridge ID wins the designated role.
5. Every port that is left is an alternate or backup port and discards. Check that each physical loop in the diagram has exactly one discarding port; if a loop has none or two, go back and find the error.
6. Only now read the question again. It usually asks about the blocking port or about what changes when a link fails, not about the root bridge itself.

Practice questions

Pick an answer to see right away whether it is correct and why every option is right or wrong.

1. Question 1 of 10Exhibit

   Four switches run Rapid PVST+ and every pair of switches is directly connected. The output of show spanning-tree vlan 10 bridge from each switch is shown. Which switch is the root bridge for VLAN 10?

   SW-A# show spanning-tree vlan 10 bridge
                                                      Hello  Max  Fwd
   Vlan                         Bridge ID              Time  Age  Dly  Protocol
   ---------------- --------------------------------- -----  ---  ---  --------
   VLAN0010         32778 (32768,  10) 0011.2233.0a01    2    20   15  rstp
   
   SW-B# show spanning-tree vlan 10 bridge
   VLAN0010         28682 (28672,  10) 0011.2233.0a99    2    20   15  rstp
   
   SW-C# show spanning-tree vlan 10 bridge
   VLAN0010         32778 (32768,  10) 0011.2233.0a00    2    20   15  rstp
   
   SW-D# show spanning-tree vlan 10 bridge
   VLAN0010         28682 (28672,  10) 0011.2233.0a02    2    20   15  rstp

   1. SW-C
   2. SW-D
   3. SW-B
   4. SW-A
   Show the answer

   Answer: B

   The bridge ID is priority first, MAC address second, and the lowest wins. Compare priorities across all switches before you look at any MAC; the MAC only matters between switches that tie on priority. The priority in show spanning-tree includes the VLAN number, so 28682 means 28672 configured for VLAN 10.

   • A. SW-C has the lowest MAC address of the four, but the MAC only breaks a tie in priority. Its priority of 32768 is higher than the 28672 configured on SW-B and SW-D, so it is out of the race.
   • B. SW-B and SW-D tie on the lowest priority (28672, shown as 28682 with the VLAN 10 extension), and SW-D's MAC 0011.2233.0a02 is lower than SW-B's 0011.2233.0a99, so SW-D has the lowest bridge ID.
   • C. SW-B shares the lowest priority with SW-D, but its MAC address 0011.2233.0a99 is higher, so it loses the tie-break and becomes a non-root bridge.
   • D. SW-A has the default priority of 32768 and a higher MAC address than SW-C, so it is the weakest candidate of the four.

2. Question 2 of 10Exhibit

   All three switches run Rapid PVST+ with default port costs, and SW1 is the root bridge for VLAN 1. Which port on SW3 is the root port, and why?

   1. Fa0/1, because it is the only port connected directly to the root bridge
   2. Fa0/1, because its lower port number wins the tie against Gi0/1
   3. Gi0/1, because its root path cost of 8 is lower than the cost of 19 on Fa0/1
   4. Gi0/1, because SW2 has a lower bridge ID than SW1 and is the preferred neighbor
   Show the answer

   Answer: C

   The root port is the port with the lowest total cost to the root bridge, not the fewest hops. Add the cost of every link on the path: 19 for 100 Mb/s, 4 for 1 Gb/s, 2 for 10 Gb/s. Only if two paths tie on cost do you compare the sender bridge ID, and then the sender port ID.

   • A. A direct link to the root does not win by itself. Fa0/1 runs at 100 Mb/s, so its root path cost is 19, which is higher than the 8 available through SW2.
   • B. Port ID is the last tie-breaker and is only consulted when root path cost and sender bridge ID are equal. Here the costs differ, so the port number never comes into play.
   • C. The path through SW2 is two 1 Gb/s hops (4 + 4 = 8), and 8 is lower than 19, so Gi0/1 becomes the root port even though it takes an extra hop.
   • D. SW1 is the root, which means it has the lowest bridge ID in the topology. SW2 cannot have a lower bridge ID than SW1, and the root port is chosen by cost before any bridge ID comparison.

3. Question 3 of 10Exhibit

   You run show spanning-tree vlan 20 on an access switch named SW-ACC2. Based on the output, which statement is accurate?

   SW-ACC2# show spanning-tree vlan 20
   
   VLAN0020
     Spanning tree enabled protocol rstp
     Root ID    Priority    24596
                Address     0011.2233.c0de
                Cost        4
                Port        25 (GigabitEthernet1/0/1)
                Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
   
     Bridge ID  Priority    32788  (priority 32768 sys-id-ext 20)
                Address     0011.2233.ac02
                Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
                Aging Time  300 sec
   
   Interface           Role Sts Cost      Prio.Nbr Type
   ------------------- ---- --- --------- -------- --------------------------------
   Gi1/0/1             Root FWD 4         128.25   P2p
   Gi1/0/2             Altn BLK 4         128.26   P2p
   Gi1/0/10            Desg FWD 19        128.34   P2p Edge

   1. The root bridge has priority 24576 configured for VLAN 20, and Gi1/0/2 forwards only if Gi1/0/1 fails
   2. SW-ACC2 is the root bridge for VLAN 20, because the Bridge ID section shows its own priority of 32788
   3. Gi1/0/2 is blocking because a loop was detected on it, and it stays down until shutdown and no shutdown are entered
   4. Gi1/0/10 is blocking because its cost of 19 is higher than the cost of 4 on the two uplink ports
   Show the answer

   Answer: A

   Read Root ID and Bridge ID separately: if the addresses differ, this switch is not the root, and the Cost and Port lines give you the root path cost and the root port. Priority values include the VLAN number, so subtract it to get the configured value. Altn BLK is a healthy alternate port; Desg FWD with Edge is a forwarding PortFast host port.

   • A. Root ID priority 24596 is 24576 plus the VLAN 20 extension, which is what root primary or priority 24576 produces. Gi1/0/2 is an alternate port in discarding state: a ready backup path that takes over if the root port goes down.
   • B. The Bridge ID section always describes the local switch. The Root ID has a different address and a lower priority, and a root bridge would show no root port and the line 'This bridge is the root'.
   • C. Altn BLK means an alternate port that RSTP keeps discarding on purpose because a cheaper path to the root exists. It is not err-disabled and it moves to forwarding on its own when it is needed.
   • D. Gi1/0/10 shows Desg FWD: a designated port that is forwarding. The cost of 19 only reflects a 100 Mb/s link speed, and Edge means PortFast is enabled on it.

4. Question 4 of 10Scenario

   Users on the third floor lose connectivity for minutes at a time. On the access switch the CPU is at 98%, the log fills with %SW_MATM-4-MACFLAP_NOTIF messages showing the same host MAC moving between Gi1/0/7 and Gi1/0/8 several times per second, and both ports show input rates close to line rate. Both are access ports in VLAN 30 with spanning-tree portfast, cabled to two wall jacks in the same meeting room. The command show spanning-tree vlan 30 returns 'Spanning tree instance(s) for vlan 30 does not exist'. Which action stops the loop without shutting down either port?

   1. Clear the MAC address table with clear mac address-table dynamic so the flapping stops
   2. Remove spanning-tree portfast from both ports so they wait 30 seconds before forwarding
   3. Configure both ports as 802.1Q trunks so the frames are tagged and no longer flood in VLAN 30
   4. Enable spanning tree for VLAN 30 with the global command spanning-tree vlan 30
   Show the answer

   Answer: D

   A bridging loop shows up as MAC address flapping between two ports, line-rate traffic, high CPU and intermittent outages. Spanning tree is the mechanism that breaks it, so first confirm it is running for the VLAN. The long-term fix is to remove whatever bridges the two jacks and to protect host ports with BPDU Guard.

   • A. Clearing the table empties it for a moment, but the frames are still circling between the two jacks, so the addresses are relearned and flap again within milliseconds.
   • B. PortFast only skips the learning delay when a port comes up; it does not turn spanning tree off. With no STP instance for VLAN 30 there is nothing to block the loop whether PortFast is on or off.
   • C. Tagging does not stop a loop. A broadcast in VLAN 30 is still sent out one port and received on the other, now with a tag, and keeps circulating.
   • D. Someone disabled spanning tree for VLAN 30 with no spanning-tree vlan 30. Re-enabling it makes the switch send BPDUs again; the BPDU sent out Gi1/0/7 comes back in on Gi1/0/8, which becomes a backup port in discarding state, and the loop ends with both ports still up.

5. Question 5 of 10Config

   Gi1/0/5 on an access switch connects to a user PC. The port must start forwarding as soon as the PC links up, and it must be disabled automatically if someone connects a switch to it. Which configuration meets both requirements?

   1. interface Gi1/0/5 switchport mode access spanning-tree portfast spanning-tree guard root
   2. interface Gi1/0/5 switchport mode access spanning-tree portfast spanning-tree bpduguard enable
   3. interface Gi1/0/5 switchport mode access spanning-tree portfast trunk spanning-tree bpdufilter enable
   4. spanning-tree portfast default spanning-tree loopguard default interface Gi1/0/5 switchport mode access
   Show the answer

   Answer: B

   PortFast belongs on access ports to end hosts, and BPDU Guard is its safety net: a PortFast port should never see a BPDU, so receiving one err-disables the port. Root guard protects the root bridge's position on designated ports, BPDU filter hides BPDUs, and loop guard handles unidirectional links. None of those three disables a port because a switch was plugged in.

   • A. PortFast gives the immediate forwarding, but root guard does not err-disable the port. On a superior BPDU it moves the port to root-inconsistent and releases it when the BPDUs stop; a switch that sends inferior BPDUs is not stopped at all.
   • B. PortFast skips the learning delay so the PC gets link and traffic at once, and BPDU Guard puts the port into err-disabled state the moment any BPDU arrives, which is exactly what a connected switch sends.
   • C. spanning-tree portfast trunk is meant for trunk ports toward routers or servers, and BPDU filter silently drops BPDUs instead of shutting the port, so a connected switch would go unnoticed.
   • D. The global PortFast default does cover access ports, but loop guard protects against unidirectional links on non-designated ports. It takes no action when a BPDU is received on this port.

6. Question 6 of 10Config

   Core-1 and Core-2 are the distribution switches for VLANs 10, 20, 30 and 40. Every switch runs Rapid PVST+ at the default priority. Core-1 must be the root bridge for VLANs 10 and 20 and the backup root for VLANs 30 and 40; Core-2 will be configured the other way round. Which configuration on Core-1 achieves its part?

   1. spanning-tree vlan 10,20 root primary spanning-tree vlan 30,40 root primary
   2. spanning-tree vlan 10,20 priority 4094 spanning-tree vlan 30,40 priority 8190
   3. spanning-tree vlan 10,20 root primary spanning-tree vlan 30,40 root secondary
   4. spanning-tree vlan 10,20 priority 32768 spanning-tree vlan 30,40 priority 36864
   Show the answer

   Answer: C

   spanning-tree vlan N root primary sets priority 24576, or 4096 less than the current root if the root is already below 24576; root secondary sets 28672. Both are macros that write a priority value into the running configuration. Setting the priority by hand works too, but it must be a multiple of 4096 between 0 and 61440.

   • A. This makes Core-1 the preferred root for all four VLANs. When Core-2 later runs root primary for VLANs 30 and 40, both cores sit at 24576 for those VLANs and the lower MAC decides, which is not a design.
   • B. Bridge priority must be a multiple of 4096. IOS rejects 4094 and 8190 with an error, so nothing changes and Core-1 stays at 32768 for every VLAN.
   • C. root primary writes priority 24576 for VLANs 10 and 20 (or 4096 below the current root if that is already lower), and root secondary writes 28672 for VLANs 30 and 40, which beats every default switch but loses to Core-2 at 24576.
   • D. 32768 is the default, so Core-1 only wins VLANs 10 and 20 if it happens to have the lowest MAC. 36864 is worse than the default, so for VLANs 30 and 40 Core-1 would lose even to an access switch.

7. Question 7 of 10Scenario

   A colleague configured spanning-tree vlan 10 priority 4096 on Dist-1 and expected it to become the root bridge for VLAN 10. Ten minutes later, show spanning-tree vlan 10 on Dist-1 still lists a Root ID with priority 4106 and address 00d0.1a2b.3c4d, while the Bridge ID of Dist-1 shows priority 4106 and address 00d0.1a2b.3c9e. What explains this?

   1. Another switch already uses priority 4096 for VLAN 10 and has a lower MAC address, so it keeps the root role
   2. The command was rejected because a priority of 4096 is below the minimum value that Rapid PVST+ accepts
   3. A priority change only takes effect after Dist-1 is reloaded, so the old election result is still being used
   4. Dist-1 needs spanning-tree vlan 10 root primary instead, because the priority command on its own does not start an election
   Show the answer

   Answer: A

   When two switches have the same priority for a VLAN, the lower MAC address wins. To take the root role, Dist-1 needs a strictly lower priority: 0 by hand, or root primary, which would compute 4096 below the current root and write 0.

   • A. Both bridge IDs show 4106, which is 4096 plus the VLAN 10 extension, so the priorities tie. The tie goes to the lower MAC address, and 00d0.1a2b.3c4d is lower than 00d0.1a2b.3c9e.
   • B. 4096 is a valid value; any multiple of 4096 from 0 to 61440 is accepted. The output proves the command worked, because the priority of Dist-1 is now 4106.
   • C. Spanning tree reacts to a priority change immediately by sending BPDUs with the new bridge ID. No reload is involved.
   • D. root primary is only a macro that calculates and writes a priority value. The priority command changes the bridge ID directly, and BPDUs carrying the new value go out right away.

8. Question 8 of 10Scenario

   A user connected a small desktop switch to the wall jack and lost all connectivity. On the access switch, show interfaces status lists Gi1/0/12 as err-disabled, and the log shows %SPANTREE-2-BLOCK_BPDUGUARD followed by %PM-4-ERR_DISABLE bpduguard error detected on Gi1/0/12. The user has since removed the desktop switch and reconnected the PC, but the port is still err-disabled. What must happen for the port to forward again?

   1. The switch recovers the port automatically once the 20-second Max Age timer expires
   2. The user reconnects the PC, and the port returns to forwarding once no BPDU has been received for two hello intervals
   3. An administrator removes spanning-tree portfast from the port, which releases it from the err-disabled state
   4. An administrator enters shutdown and no shutdown on the port, or errdisable recovery is configured
   Show the answer

   Answer: D

   BPDU Guard err-disables a port that receives a BPDU. Err-disabled is a sticky state: the port does not come back when the offending device is removed. Recovery is manual (shutdown, no shutdown) unless errdisable recovery cause bpduguard is configured, with errdisable recovery interval setting the retry time.

   • A. Max Age is a BPDU aging timer used by spanning tree, not an err-disable recovery timer. A port that BPDU Guard err-disabled stays down until someone intervenes or errdisable recovery is in place.
   • B. The absence of BPDUs does not reset the port. Err-disabled is a shutdown state at the port level, so the link to the PC does not even come up, which is why the user lost connectivity.
   • C. Changing PortFast does not clear an err-disabled state. The switch has shut the port, and it stays that way regardless of its spanning tree settings until it is reset.
   • D. Err-disabled ports stay down until shutdown followed by no shutdown is entered on the interface, unless errdisable recovery cause bpduguard was configured, in which case the switch retries after the recovery interval, 300 seconds by default.

9. Question 9 of 10Scenario

   Which two statements about Rapid PVST+ (802.1w) on a Cisco switch are true? (Choose two.)

   1. An alternate port is kept in discarding state and provides a backup path to the root bridge
   2. A port in the listening state learns MAC addresses before it moves on to forwarding
   3. With the default short path-cost method, a 1 Gb/s link costs 4 and a 10 Gb/s link costs 2
   4. A backup port is placed in forwarding state to load-share with the designated port on the same segment
   5. Root guard should be enabled on the root port of each access switch so the root bridge cannot change
   Show the answer

   Answer: A and C

   802.1w has three port states (discarding, learning, forwarding) and four roles (root, designated, alternate, backup). Alternate backs up the root port, backup backs up a designated port, and both discard. Short path costs are 19, 4 and 2 for 100 Mb/s, 1 Gb/s and 10 Gb/s. Root guard goes on ports where the root should never appear, never on the path toward the root.

   • A. RSTP keeps an alternate port discarding and moves it to forwarding quickly when the root port fails; it replaces the 802.1D blocking port that led toward the root.
   • B. Listening is an 802.1D state and does not learn addresses. RSTP has only discarding, learning and forwarding, and learning is the state in which MAC addresses are added to the table.
   • C. The short method uses 19 for 100 Mb/s, 4 for 1 Gb/s and 2 for 10 Gb/s, which is what show spanning-tree displays on a Cisco switch by default.
   • D. A backup port is a redundant port on the same segment as a designated port of the same switch, usually through a hub. It stays discarding; it never forwards alongside the designated port.
   • E. Root guard belongs on designated ports facing switches that must never become root. On a root port it would see the superior BPDUs of the real root, mark the port root-inconsistent and cut the switch off from the root.

10. Question 10 of 10Exhibit

    All links run at 1 Gb/s and all three switches run Rapid PVST+ with default costs. Which port is in the discarding state for VLAN 1?

    1. SW3 Gi0/2
    2. SW2 Gi0/2
    3. SW2 Gi0/1
    4. SW1 Gi0/2
    Show the answer

    Answer: B

    Each segment needs exactly one designated port. On a link between two non-root switches with equal root path cost, the switch with the lower bridge ID wins the designated role and the other end becomes an alternate port in discarding state. Ports on the root bridge are always designated.

    • A. SW2 and SW3 both reach the root at cost 4, so the designated port on the SW2-SW3 link goes to the lower sender bridge ID. SW3's MAC 0011.2233.4400 is lower than SW2's 0011.2233.4455, so SW3 Gi0/2 is designated and forwards.
    • B. SW2 loses the designated-port comparison on the SW2-SW3 segment because its bridge ID is higher than SW3's, so SW2 Gi0/2 becomes the alternate port and discards.
    • C. SW2 Gi0/1 is SW2's root port: the direct 1 Gb/s link to SW1 costs 4, while the path through SW3 would cost 8.
    • D. Every port on the root bridge is a designated port and forwards. SW1 Gi0/2 is the designated port for the SW1-SW3 segment.

Common mistakes

• Choosing the root bridge by lowest MAC address without checking the priority first. A priority of 28672 beats any MAC address that sits behind a default 32768.
• Counting hops instead of adding costs. Two 1 Gb/s hops (4 + 4 = 8) beat a single 100 Mb/s hop (19), so the root port can point away from the direct link to the root.
• Reading the Bridge ID section of show spanning-tree as if it described the root. The Root ID section names the root; if the two addresses differ, this switch is not the root.
• Enabling PortFast on a port that leads to another switch. With BPDU Guard the port err-disables; without it, the port forwards before spanning tree has checked for a loop.
• Expecting a port that BPDU Guard err-disabled to recover by itself. Unless errdisable recovery is configured, it stays down until someone enters shutdown and no shutdown.

Questions people ask

More CCNA topics

• CCNA Subnetting Practice Questions
• CCNA OSPF Practice Questions: Single-Area OSPFv2
• CCNA VLANs and Trunking: Practice Questions
• CCNA ACL Practice Questions
• CCNA NAT, PAT and Port Forwarding Practice Questions
• CCNA IPv6 Practice Questions: Addressing, EUI-64, SLAAC and NDP
• CCNA EtherChannel: Practice Questions
• CCNA First-Hop Redundancy Practice Questions: HSRP, VRRP and GLBP
• CCNA Wireless Fundamentals Practice Questions
• CCNA Static Routing Practice Questions: ip route and the Routing Table
• CCNA IP Services Practice Questions
• CCNA Layer 2 Security Practice Questions
• CCNA Security Fundamentals Practice Questions (200-301)
• CCNA QoS Practice Questions (200-301)
• CCNA Automation and Programmability Practice Questions
• CCNA practice test: all domains