Based on the spanning tree topology, on which ports should the network administrator implement root guard?