Which command should be executed to configure BPDU Guard on an access port?

To configure BPDU Guard on an access port, the correct command is "spanning-tree bpduguard enable." This command specifically enables BPDU Guard globally or on a per-port basis in a Cisco switch configuration. When BPDU Guard is enabled on a port that is operating in PortFast mode, it helps to prevent potential loops by shutting down the port if a Bridge Protocol Data Unit (BPDU) is received on that port. This is particularly important on access ports where you do not expect BPDUs, as they are typically connecting end devices like computers or IP phones.

Understanding why this command is effective involves recognizing its function within the spanning tree protocol environment. BPDU Guard is critical for ensuring that the access ports maintain a loop-free topology by detecting misconfigurations or accidental device connections that may introduce BPDUs into a segment where they should not be.

The alternative options do not accurately provide the correct syntax or functionality for enabling BPDU Guard. For example, "spanning-tree guard bpdu" does not correspond to a valid command in Cisco IOS, while "spanning-tree portfast bpduguard" incorrectly suggests that both PortFast and BPDU Guard are configured in a single command, which is not how Cisco IOS handles these features