Loop Guardis designed to protect againstSTP loop conditionsthat may occur whenBPDUs are unexpectedly missingon a point-to-point link. This is especially relevant in cases where UDLD (Unidirectional Link Detection) might not detect the problem quickly enough. When BPDUs are absent, a switch might erroneously assume that the link is safe to forward, potentially leading to atemporary Layer 2 loop.
UsingLoop Guardensures that a port moves into aloop-inconsistentstate instead of forwarding traffic if BPDUs are missing, effectively stopping a loop before it forms. This makes it acomplementary mechanism to UDLD, which focuses on detecting unidirectional links at the physical layer, not STP control plane failures.
This recommendation aligns with CCDE v3.1 best practices forresilient Layer 2 designs, which emphasize using multiple mechanisms in tandem to proactively prevent failure conditions before traffic is impacted.
Why other options are incorrect:
* A. Root Guard: Prevents an unauthorized switch from becoming the root bridge but doesn't protect against missing BPDUs.
* B. BPDU Guard: Used mainly on access ports to prevent BPDU reception; not intended for core loop prevention.
* D. BPDU Filtering: Suppresses BPDU exchange entirely, which increases loop risk and is not suited for loop mitigation.

* A (Establish visibility and behavior modeling):After discovering applications, Zero Trust design requires baseline visibility into traffic flows, system behavior, and interaction patterns. This modeling allows for the design of effective microsegmentation and policy enforcement.
Other options explained:
* B: Policy enforcement comes after visibility and modeling.
* C: Health assessment is a continuous activity but not the next step.
* D: Trust assessment is part of the initial Zero Trust design, not specifically after discovery.