To prevent a spanning-tree attack, which command should be configured on a distribution switch
port that is connected to an access switch?
A.
spanning-tree portfast bpduguard default
B.
spanning-tree backbone fast
C.
spannning-tree bpduguard enable
D.
spanning-tree guard root
Explanation:
To mitigate STP manipulation, two different features can be used. The Root Guard feature is
configured on a switchport that should never become a root port, or in other words, the port that
forwards traffic going toward the root bridge. A good example of this would be a connection
between a distribution layer switch and an access layer switch. In this scenario, the port on the
distribution switch going toward the access layer should never become a root port because the
access layer switch should never become the root switch. If the switchport does receive a superior
BPDU, the port will go into root-inconsistent state, indicating that another switch is attempting to
become the root switch.
Enables the Root Guard feature on a switchport
Switch(config-if)# spanning-tree guard root