300-410 SPAN, RSPAN, and ERSPAN — All Questions With Answers

A network engineer configures SPAN on a Cisco Catalyst switch to monitor traffic between two hosts. The engineer configures the source interface as GigabitEthernet0/1 and the destination interface as GigabitEthernet0/2. After the configuration, the engineer notices that the monitored traffic is not being forwarded to the destination port. What is the most likely cause?

Question 2mediummultiple choice

An engineer configures RSPAN on a Cisco switch to monitor traffic from VLAN 10 across multiple switches. The engineer creates an RSPAN VLAN (VLAN 100) on the source switch and configures the source as VLAN 10. On the remote switch, the engineer configures the destination port as GigabitEthernet0/1 in VLAN 100. However, the destination port does not forward any monitored traffic. What is the most likely cause?

Question 3hardmultiple choice

A network engineer is troubleshooting an ERSPAN configuration where traffic from a source router is being sent to a remote monitoring server. The engineer configures an ERSPAN source session on Router A to capture traffic on GigabitEthernet0/0 and send it to the IP address 10.1.1.100. The monitoring server does not receive any packets. The engineer verifies that IP connectivity exists between Router A and the server. What is the most likely cause?

Question 4mediummultiple choice

An engineer configures a local SPAN session on a Cisco switch to monitor all traffic on VLAN 20. The engineer uses the command 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface GigabitEthernet0/3'. The engineer connects a laptop to GigabitEthernet0/3 and runs a packet capture, but sees only traffic from the switch itself, not from other devices in VLAN 20. What is the most likely cause?

Question 5hardmultiple choice

A network engineer configures an RSPAN session on Switch A to monitor traffic from interface GigabitEthernet0/1 and sends it to Switch B. The engineer creates RSPAN VLAN 50 on both switches and configures the trunk between them to allow VLAN 50. On Switch B, the engineer configures the destination port as GigabitEthernet0/2 in VLAN 50. The engineer notices that the destination port is not forwarding any traffic. What should the engineer check first?

Question 6hardmultiple choice

An engineer configures ERSPAN on a Cisco router to monitor traffic on interface GigabitEthernet0/0/0 and send it to a monitoring server at 192.168.1.100. The engineer configures the ERSPAN session with a tunnel source of 10.0.0.1 and a tunnel destination of 192.168.1.100. The monitoring server receives no packets. The engineer pings 192.168.1.100 from the router and succeeds. What is the most likely cause?

Question 7mediummultiple choice

A network engineer configures a SPAN session on a Cisco switch to monitor traffic on interface GigabitEthernet0/1 and sends it to interface GigabitEthernet0/2. The engineer notices that the destination port is up but does not forward any traffic. The engineer checks the configuration and sees that the destination port is configured as a trunk port. What is the most likely cause?

Question 8hardmultiple choice

An engineer configures an RSPAN session on a Cisco switch to monitor traffic from VLAN 30 and send it to a remote switch. The engineer creates RSPAN VLAN 200 on both switches and configures the trunk to allow VLAN 200. On the remote switch, the engineer configures the destination port as GigabitEthernet0/4 in VLAN 200. The engineer notices that the destination port is forwarding traffic, but the traffic is not from the source VLAN 30; instead, it is broadcast traffic from other VLANs. What is the most likely cause?

Question 9hardmultiple choice

A network engineer configures an ERSPAN session on a Cisco router to monitor traffic on interface GigabitEthernet0/0/0 and send it to a monitoring server at 172.16.1.100. The engineer uses the command 'monitor session 1 type erspan-source' and configures the tunnel. The monitoring server receives packets, but the packets contain only the original source and destination IP addresses of the monitored traffic, not the encapsulated GRE headers. What is the most likely cause?

Question 10mediummultiple choice

A network engineer runs the following command on switch SW1:

SW1# show monitor session 1

Session 1 --------- Type : Local Session Source Ports : Both : Gi0/1, Gi0/2 Destination Ports : Gi0/3

Encapsulation : Native

Ingress : Disabled

Based on this output, which statement is correct?

Question 11mediummultiple choice

A network engineer runs the following command on switch SW2:

SW2# show monitor session 2

Session 2 --------- Type : Remote Source Session Source Ports : Both : Gi0/4 Source VLANs : RX Only : 100 Destination Ports : Gi0/5

Encapsulation : Native

Ingress : Disabled

Based on this output, which statement is correct?

Question 12mediummultiple choice

A network engineer runs the following command on switch SW3:

SW3# show monitor session 3

Session 3 --------- Type : Remote Destination Session Source Ports : RX Only : Gi0/6 Destination Ports : Gi0/7

Encapsulation : Native

Ingress : Disabled

Based on this output, which statement is correct?

Question 13mediummultiple choice

A network engineer runs the following command on router R2:

R2# show monitor session 4

Session 4 --------- Type : ERSPAN Source Session Status : Admin Enabled Source Ports : Both : Gi0/0 Destination IP : 192.168.1.10 Origin IP : 10.0.0.2 ERSPAN ID : 100

Based on this output, which statement is correct?

Question 14mediummultiple choice

A network engineer runs the following command on router R3:

R3# show monitor session 5

Session 5 --------- Type : ERSPAN Destination Session Status : Admin Enabled Source IP : 10.0.0.2 Destination Ports : Gi0/1

Encapsulation : Native

Ingress : Disabled ERSPAN ID : 100

Based on this output, which statement is correct?

Question 15hardmultiple choice

A network engineer runs the following command on switch SW4:

SW4# show monitor session 6

Session 6 --------- Type : Local Session Source Ports : Both : Gi0/8, Gi0/9 Destination Ports : Gi0/10

Encapsulation : Native

Ingress : Enabled

Based on this output, which statement is correct?

Question 16mediummultiple choice

A network engineer runs the following command on switch SW5:

SW5# show monitor session 7

Session 7 --------- Type : Local Session Source Ports : Both : Gi0/11 Destination Ports : Gi0/12

Encapsulation : Replicate

Ingress : Disabled

Based on this output, which statement is correct?

Question 17hardmultiple choice

A network engineer runs the following command on switch SW6:

SW6# show monitor session 8

Session 8 --------- Type : Remote Source Session Source Ports : Both : Gi0/13 Source VLANs : TX Only : 200 Destination Ports : Gi0/14

Encapsulation : Dot1q

Ingress : Disabled

Based on this output, which statement is correct?

Question 18mediummultiple choice

A network engineer runs the following command on router R4:

R4# show monitor session 9

Session 9 --------- Type : ERSPAN Source Session Status : Admin Disabled Source Ports : Both : Gi0/2 Destination IP : 192.168.2.20 Origin IP : 10.0.0.3 ERSPAN ID : 200

Based on this output, which statement is correct?

Question 19mediummultiple choice

Consider the following partial configuration on a Cisco IOS-XE switch:

monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination interface GigabitEthernet1/0/2

What is the effect of this configuration?

Question 20mediummultiple choice

Given the configuration:

monitor session 2 source vlan 10-12 both monitor session 2 destination interface GigabitEthernet1/0/3

Which statement is true?

Question 21mediummultiple choice

Examine the RSPAN configuration:

vlan 100

name RSPAN_VLAN remote-span ! monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination remote vlan 100

What is the purpose of the 'remote-span' command under VLAN 100?

Question 22mediummultiple choice

Consider the ERSPAN configuration on a router:

monitor session 1 type erspan-source source interface GigabitEthernet0/0/1 both destination erspan-id 1

ip address 192.168.1.100

origin ip address 192.168.1.1

What is the primary purpose of the 'origin ip address' command?

Question 23mediummultiple choice

A network engineer configured the following:

monitor session 3 type erspan-source source interface GigabitEthernet0/0/2 rx destination erspan-id 2

ip address 10.0.0.2

origin ip address 10.0.0.1

What traffic will be mirrored?

Question 24mediummultiple choice

Read the full SPAN, RSPAN, and ERSPAN explanation →

What is missing from this RSPAN configuration on a switch?

monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination remote vlan 100

Assume VLAN 100 exists but is not configured as an RSPAN VLAN.

Question 25easymultiple choice

What is the default behavior of a local SPAN session if no direction (rx, tx, both) is specified?

Question 26easymultiple choice

Read the full SPAN, RSPAN, and ERSPAN explanation →

In ERSPAN, what is the default encapsulation type used for transporting mirrored packets across an IP network?

Question 27mediummultiple choice

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which of the following is a limitation of local SPAN on a Cisco switch?

Question 28mediummulti select

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which TWO commands verify the operational status of a local SPAN session on a Cisco IOS-XE switch? (Choose TWO.)

Question 29hardmulti select

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which THREE symptoms indicate a misconfigured RSPAN session on a Cisco switch? (Choose THREE.)

Question 30mediummulti select

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which TWO configuration steps are required to set up an ERSPAN session on a Cisco IOS-XE device? (Choose TWO.)

Question 31mediummulti select

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which TWO statements about RSPAN are true? (Choose TWO.)

Question 32hardmulti select

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which THREE commands are used to troubleshoot a SPAN session on a Cisco Catalyst switch? (Choose THREE.)

Question 33hardmultiple choice

An engineer configures ERSPAN on Router R1 to monitor traffic from VLAN 100 to a remote collector at 192.168.10.10 via a GRE tunnel. The source interface is GigabitEthernet0/0/0. After configuration, the collector receives no mirrored packets. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 100 ip address 192.168.10.10 origin ip address 10.1.1.1 no shutdown. R1's routing table shows a default route via 10.1.1.2, and a static route to 192.168.10.0/24 via 10.1.1.2. The tunnel interface Tunnel0 is up/up with IP 10.1.1.1/30. What is the most likely root cause?

Question 34hardmultiple choice

Study the full ACL explanation →

A network engineer configures RSPAN on a switch to monitor traffic from VLAN 10 to a remote switch via VLAN 100 as the RSPAN VLAN. The source switch has: monitor session 1 source vlan 10 rx monitor session 1 destination remote vlan 100. The remote switch has: monitor session 2 source remote vlan 100 monitor session 2 destination interface Gi0/1. The remote switch's Gi0/1 is connected to a network analyzer. The analyzer sees no traffic. The RSPAN VLAN 100 is configured on all intermediate switches with the 'remote-span' command. However, the intermediate switches run MST and VLAN 100 is mapped to a different MST instance than the native VLAN. What is the root cause?

Question 35hardmultiple choice

Router R1 is configured as an ERSPAN source to monitor traffic on interface Serial0/0/0. The destination is a collector at 172.16.1.100. R1's configuration: monitor session 1 type erspan-source source interface Serial0/0/0 both destination erspan-id 1 ip address 172.16.1.100 origin ip address 10.0.0.1. The collector is reachable via a default route. The network also uses CoPP (Control Plane Policing) with a policy that polices all incoming traffic to the control plane. The collector receives no packets. What is the most likely issue?

Question 36hardmultiple choice

Review the full OSPF breakdown →

A network engineer configures SPAN on a switch to monitor traffic from VLAN 20 to a local analyzer on interface Gi0/1. The configuration: monitor session 1 source vlan 20 rx monitor session 1 destination interface Gi0/1. The analyzer sees no traffic. The switch runs OSPF and has a route to 0.0.0.0/0 via a neighbor. The Gi0/1 interface is configured as a trunk port with native VLAN 1. The analyzer is connected to a hub that also connects to another device. The other device sends traffic that causes the switch to learn MAC addresses on Gi0/1. What is the root cause?

Question 37hardmultiple choice

An engineer configures ERSPAN on Router R1 to monitor traffic from VLAN 30 to a collector at 192.168.1.100. The router has multiple VRFs: VRF A and VRF B. The source interface Gi0/0/0 is in VRF A. The collector is in VRF B. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 2 ip address 192.168.1.100 origin ip address 10.0.0.1. The collector is reachable via a route in VRF B. The router has a route-leaking configuration between VRFs. The collector receives no traffic. What is the root cause?

Question 38hardmultiple choice

Study the full ACL explanation →

A switch is configured with RSPAN to monitor traffic from VLAN 50 to a remote switch via VLAN 200. The source switch has: monitor session 1 source vlan 50 rx monitor session 1 destination remote vlan 200. The remote switch has: monitor session 2 source remote vlan 200 monitor session 2 destination interface Gi0/2. The intermediate switches have VLAN 200 configured with 'remote-span'. The network uses VTP transparent mode. The analyzer connected to Gi0/2 sees intermittent traffic. The RSPAN VLAN 200 is also used as a native VLAN on some trunk ports. What is the likely cause of intermittent traffic?

Question 39hardmultiple choice

Router R1 is configured as an ERSPAN source to monitor traffic on interface GigabitEthernet0/0/0. The destination is a collector at 10.10.10.10. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 3 ip address 10.10.10.10 origin ip address 192.168.1.1. The router has an ACL applied to the interface Gi0/0/0 that denies all IP traffic from source 192.168.1.1. The collector receives no packets. What is the root cause?

Question 40hardmultiple choice

Read the full EtherChannel explanation →

A switch is configured with SPAN to monitor traffic on interface Gi0/0/0 to a local analyzer on interface Gi0/1. The configuration: monitor session 1 source interface Gi0/0/0 both monitor session 1 destination interface Gi0/1. The analyzer sees only half of the traffic (only incoming or outgoing). The switch also has an EtherChannel configured on Gi0/0/0 as part of a port-channel. The port-channel is up/up. What is the root cause?

Question 41hardmultiple choice

Read the full VPN explanation →

Router R1 is configured as an ERSPAN source to monitor traffic on interface Tunnel0 (a DMVPN tunnel). The destination is a collector at 172.16.0.100. R1's configuration: monitor session 1 type erspan-source source interface Tunnel0 both destination erspan-id 4 ip address 172.16.0.100 origin ip address 10.0.0.1. The collector receives no packets. The Tunnel0 interface is up/up and has an IP of 10.0.0.1/30. The tunnel destination is 192.168.1.1. The router has a route to 172.16.0.100 via 10.0.0.2. What is the root cause?

Question 42mediummultiple choice

A network engineer runs the following command to troubleshoot a SPAN issue:

R1# show monitor session 1 detail

Session 1 --------- Type : Local Session Source Ports : Both : Gi0/0 Destination Ports : Gi0/1

Encapsulation      : Native

Ingress : Disabled

What does this output indicate?

Question 43mediummultiple choice

A network engineer runs the following command to troubleshoot an RSPAN issue:

R1# show monitor session 2 detail

Session 2 --------- Type : Remote Source Session Source Ports : Both : Gi0/0 Destination RSPAN VLAN : 100

What does this output indicate?

Question 44mediummultiple choice

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show monitor session 3 detail

Session 3 --------- Type : ERSPAN Source Session Source Ports : Both : Gi0/0 Destination IP : 10.1.1.1 ERSPAN ID : 100

What does this output indicate?

Question 45mediummultiple choice

A network engineer runs the following command to troubleshoot an RSPAN issue:

R1# show monitor session 4 detail

Session 4 --------- Type : Remote Destination Session Source RSPAN VLAN : 100 Destination Ports : Gi0/2

Encapsulation      : Native

Ingress : Disabled

What does this output indicate?

Question 46mediummultiple choice

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show monitor session 5 detail

Session 5 --------- Type : ERSPAN Destination Session Source IP : 10.1.1.2 ERSPAN ID : 100 Destination Ports : Gi0/3

Encapsulation      : Native

Ingress : Disabled

What does this output indicate?

Question 47hardmultiple choice

A network engineer runs the following command to troubleshoot a SPAN issue:

R1# show monitor session all

Session 1 --------- Type : Local Session Source Ports : Both : Gi0/0 Destination Ports : Gi0/1

Encapsulation      : Native

Ingress : Disabled

Session 2 --------- Type : Remote Source Session Source Ports : Both : Gi0/2 Destination RSPAN VLAN : 100

What does this output indicate?

Question 48hardmultiple choice

Read the full SPAN, RSPAN, and ERSPAN explanation →

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show monitor session 6 detail

Session 6 --------- Type : ERSPAN Source Session Source VLANs : Both : 10-20 Destination IP : 10.1.1.3 ERSPAN ID : 200

What does this output indicate?

Question 49mediummultiple choice

A network engineer runs the following command to troubleshoot a SPAN issue:

R1# debug monitor session 1
*Mar  1 00:00:01.123: MONITOR: Session 1: Packet captured on Gi0/0, forwarded to Gi0/1
*Mar  1 00:00:02.456: MONITOR: Session 1: Packet captured on Gi0/0, forwarded to Gi0/1

What does this output indicate?

Question 50hardmultiple choice

Read the full SPAN, RSPAN, and ERSPAN explanation →

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show ip interface brief | include Gi0/0

GigabitEthernet0/0 10.1.1.1 YES NVRAM up up

R1# show monitor session 7 detail

Session 7 --------- Type : ERSPAN Source Session Source Ports : Both : Gi0/1 Destination IP : 10.1.1.2 ERSPAN ID : 300

What does this output indicate?

Question 51mediummultiple choice

What is the default ERSPAN encapsulation type on Cisco IOS-XE devices?

Question 52mediummultiple choice

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which statement about the SPAN destination port behavior is correct?

Question 53hardmultiple choice

What is the maximum number of source ports that can be monitored in a single SPAN session on a typical Cisco Catalyst switch?

Question 54mediummultiple choice

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which statement about RSPAN VLAN is correct?

Question 55hardmultiple choice

What is the default ERSPAN ID range on Cisco IOS-XE devices?

Question 56easymultiple choice

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which of the following is true about the SPAN source interface configuration?

Question 57hardmultiple choice

Read the full SPAN, RSPAN, and ERSPAN explanation →

What is the maximum number of ERSPAN sessions that can be configured on a Cisco IOS-XE router?

Question 58mediummultiple choice

Which statement about RSPAN source session is correct?

Question 59hardmultiple choice

Read the full SPAN, RSPAN, and ERSPAN explanation →

What is the default MTU size for ERSPAN encapsulated packets on Cisco IOS-XE?

Question 60mediumdrag order

Read the full SPAN, RSPAN, and ERSPAN explanation →

Drag and drop the steps to configure an ERSPAN session for remote traffic capture into the correct order, from first to last.

Question 61harddrag order

Read the full SPAN, RSPAN, and ERSPAN explanation →

Drag and drop the steps to troubleshoot SPAN, RSPAN, and ERSPAN adjacency or connectivity failures into the correct order, from first to last.

Question 62mediumdrag order

Read the full SPAN, RSPAN, and ERSPAN explanation →

Drag and drop the steps to verify and validate SPAN, RSPAN, and ERSPAN operational state into the correct order, from first to last.

Question 63hardmulti select

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which TWO statements about ERSPAN source session configuration are correct? (Choose TWO.)

Question 64hardmulti select

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which TWO statements about RSPAN configuration and operation are correct? (Choose TWO.)

Question 65hardmulti select

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which TWO statements about the limitations of local SPAN are correct? (Choose TWO.)

Question 66hardmulti select

Read the full SPAN, RSPAN, and ERSPAN explanation →

Which TWO statements about verifying SPAN, RSPAN, and ERSPAN sessions are correct? (Choose TWO.)

Question 67hardmulti select

Which TWO statements about the configuration of an ERSPAN destination session are correct? (Choose TWO.)

Question 68hardmultiple choice

An engineer configures SPAN on a Cisco switch to monitor traffic from a source VLAN. Unexpectedly, BPDU guard shuts down the monitoring port when a switch is connected to it. Which is the most likely explanation?

Question 69hardmultiple choice

An engineer configures RSPAN VLAN 100 on two switches to monitor traffic across the network. The remote switch shows the RSPAN source as active, but the destination switch receives no mirrored traffic. What is the most likely cause?

Question 70hardmultiple choice

An engineer configures ERSPAN on a Cisco router to send mirrored traffic to a remote collector via IP. The collector receives the ERSPAN packets, but the payload appears truncated or malformed. What is the most likely cause?

Question 71hardmultiple choice

Read the full VRF explanation →

An engineer configures SPAN on a Cisco switch to monitor both ingress and egress traffic on a trunk port. The monitor session shows only egress traffic, not ingress. What is the most likely explanation?

Question 72hardmultiple choice

An engineer configures ERSPAN on a Cisco router to monitor traffic from a VRF. The mirrored traffic reaches the collector, but the source IP address in the ERSPAN header is the router's loopback, not the expected interface IP. What is the most likely cause?

Question 73hardmultiple choice

An engineer configures RSPAN on a switch stack to monitor traffic from a VLAN. The RSPAN destination port is on a different stack member. The mirrored traffic works intermittently, with gaps during stack master re-election. What is the most likely explanation?

Question 74hardmultiple choice

An engineer configures SPAN on a Cisco switch to monitor traffic from a port that is also a SPAN destination for another session. The switch rejects the configuration. What is the most likely reason?

Question 75hardmultiple choice

An engineer configures ERSPAN on a Cisco router to monitor traffic from a tunnel interface. The mirrored traffic shows the tunnel's inner IP headers, but the outer encapsulation is missing. What is the most likely cause?

Question 76hardmultiple choice