300-410 SPAN, RSPAN, and ERSPAN Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on switch SW5:

SW5# show monitor session 7
Session 7
---------
Type : Local Session
Source Ports :
    Both : Gi0/11
Destination Ports : Gi0/12
    Encapsulation : Replicate
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The SPAN session will replicate the original VLAN tag on the mirrored traffic sent to Gi0/12.. This is a local SPAN session with source port Gi0/11 and destination port Gi0/12. The encapsulation is set to 'Replicate', which means the mirrored traffic retains its original VLAN tag. This is typical when the destination port is a trunk port and the analyzer expects tagged traffic.

Answer

The SPAN session will strip the VLAN tag from the mirrored traffic.

Answer

The SPAN session is using RSPAN because the encapsulation is set to Replicate.

Answer

The SPAN session is misconfigured because encapsulation Replicate is not supported.

Question 2

A network engineer runs the following command on switch SW6:

SW6# show monitor session 8
Session 8
---------
Type : Remote Source Session
Source Ports :
    Both : Gi0/13
Source VLANs :
    TX Only : 200
Destination Ports : Gi0/14
    Encapsulation : Dot1q
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The RSPAN source session sends mirrored traffic to Gi0/14 with a Dot1q tag.. This is an RSPAN source session. It monitors source port Gi0/13 and source VLAN 200 (TX only), and sends the mirrored traffic to destination port Gi0/14 with Dot1q encapsulation. The Dot1q encapsulation indicates that the destination port is a trunk port carrying the RSPAN VLAN. The session is correctly configured.

Answer

The RSPAN source session sends mirrored traffic to Gi0/14 without any VLAN tag.

Answer

The session is an ERSPAN source session because it uses Dot1q encapsulation.

Answer

The session is misconfigured because source VLANs cannot be TX only.

Question 3

A network engineer runs the following command on router R4:

R4# show monitor session 9
Session 9
---------
Type : ERSPAN Source Session
Status : Admin Disabled
Source Ports :
    Both : Gi0/2
Destination IP : 192.168.2.20
Origin IP : 10.0.0.3
ERSPAN ID : 200

Based on this output, which statement is correct?

Accepted Answer

The ERSPAN session is configured but not currently active because it is administratively disabled.. This is an ERSPAN source session that is administratively disabled. The configuration is present but not active. To enable it, the engineer must use the 'no shutdown' command under the session configuration.

Answer

The ERSPAN session is actively mirroring traffic from Gi0/2 to 192.168.2.20.

Answer

The ERSPAN session is using RSPAN because the status is disabled.

Answer

The ERSPAN session is misconfigured because the origin IP is missing.

Question 4

Consider the following partial configuration on a Cisco IOS-XE switch:

monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination interface GigabitEthernet1/0/2

What is the effect of this configuration?

Accepted Answer

It copies all traffic received and transmitted on GigabitEthernet1/0/1 to GigabitEthernet1/0/2.. This configures a local SPAN session that copies traffic from GigabitEthernet1/0/1 (both ingress and egress) to GigabitEthernet1/0/2 for monitoring.

Answer

It copies only ingress traffic from GigabitEthernet1/0/1 to GigabitEthernet1/0/2.

Answer

It copies only egress traffic from GigabitEthernet1/0/1 to GigabitEthernet1/0/2.

Answer

It copies traffic from GigabitEthernet1/0/2 to GigabitEthernet1/0/1.

Question 5

Given the configuration:

monitor session 2 source vlan 10-12 both
monitor session 2 destination interface GigabitEthernet1/0/3

Which statement is true?

Accepted Answer

Traffic from all ports in VLANs 10, 11, and 12 is copied to GigabitEthernet1/0/3.. This configures a VLAN-based SPAN session that monitors all traffic on VLANs 10, 11, and 12 and sends a copy to GigabitEthernet1/0/3.

Answer

Only traffic from the access ports in VLAN 10 is copied.

Answer

The destination port must be in VLAN 10.

Answer

The destination port will become a SPAN destination and cannot be used for normal traffic.

Question 6

Examine the RSPAN configuration:

vlan 100
 name RSPAN_VLAN
 remote-span
!
monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination remote vlan 100

What is the purpose of the 'remote-span' command under VLAN 100?

Accepted Answer

It allows VLAN 100 to be used for RSPAN traffic across multiple switches.. The 'remote-span' command designates VLAN 100 as an RSPAN VLAN, allowing it to carry mirrored traffic across switches without being used for normal data traffic.

Answer

It enables spanning tree on VLAN 100.

Answer

It configures VLAN 100 as a native VLAN.

Question 7

Consider the ERSPAN configuration on a router:

monitor session 1 type erspan-source
 source interface GigabitEthernet0/0/1 both
 destination
  erspan-id 1
  ip address 192.168.1.100
  origin ip address 192.168.1.1

What is the primary purpose of the 'origin ip address' command?

Accepted Answer

It defines the source IP address used in the ERSPAN GRE encapsulation.. The origin IP address is the source IP used in the ERSPAN encapsulated packets, allowing the destination to identify the source of the mirrored traffic.

Answer

It specifies the IP address of the monitoring device.

Answer

It sets the IP address of the interface being monitored.

Answer

It enables ERSPAN on the specified interface.

Question 8

A network engineer configured the following:

monitor session 3 type erspan-source
 source interface GigabitEthernet0/0/2 rx
 destination
  erspan-id 2
  ip address 10.0.0.2
  origin ip address 10.0.0.1

What traffic will be mirrored?

Accepted Answer

Only traffic received on GigabitEthernet0/0/2.. The 'rx' keyword indicates that only ingress (received) traffic on GigabitEthernet0/0/2 will be mirrored.

Answer

Only traffic transmitted on GigabitEthernet0/0/2.

Answer

Both received and transmitted traffic on GigabitEthernet0/0/2.

Answer

All traffic on the router, regardless of interface.

Question 9

What is missing from this RSPAN configuration on a switch?

monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination remote vlan 100

Assume VLAN 100 exists but is not configured as an RSPAN VLAN.

Accepted Answer

The 'remote-span' command under VLAN 100.. For RSPAN to work, the VLAN used as the destination remote VLAN must be configured with the 'remote-span' command. Without it, the session will not function correctly.

Answer

An IP address on the destination interface.

Answer

A destination interface on the source switch.

Answer

The 'no shutdown' command on VLAN 100.

Question 10

What is the default behavior of a local SPAN session if no direction (rx, tx, both) is specified?

Accepted Answer

Both ingress and egress traffic are monitored.. If no direction is specified, the default is to monitor both ingress and egress traffic on the source interface.

Answer

Only ingress traffic is monitored.

Answer

Only egress traffic is monitored.

Answer

No traffic is monitored until direction is explicitly set.

Question 11

In ERSPAN, what is the default encapsulation type used for transporting mirrored packets across an IP network?

Accepted Answer

GRE. ERSPAN uses GRE (Generic Routing Encapsulation) to encapsulate the original packets for transport over an IP network.

Answer

IPsec

Answer

MPLS

Answer

VXLAN

Question 12

Which of the following is a limitation of local SPAN on a Cisco switch?

Accepted Answer

It cannot mirror traffic to a remote switch.. Local SPAN can only mirror traffic to a destination port on the same switch; it cannot send mirrored traffic across the network without additional configuration like RSPAN or ERSPAN.

Answer

It can only monitor one source interface per session.

Answer

The destination port must be in the same VLAN as the source.

Answer

It cannot monitor both ingress and egress traffic simultaneously.

Question 13

Which TWO commands verify the operational status of a local SPAN session on a Cisco IOS-XE switch? (Choose TWO.)

Accepted Answer

show monitor session 1. The 'show monitor session 1' command displays details of a specific SPAN session, including source and destination interfaces and operational state. The 'show monitor' command lists all configured SPAN sessions and their status. 'show spanning-tree' is unrelated, 'show interfaces' does not show SPAN status, and 'show vlan' is for VLAN information.

Answer

show spanning-tree

Answer

show interfaces

Answer

show vlan

Question 14

Which THREE symptoms indicate a misconfigured RSPAN session on a Cisco switch? (Choose THREE.)

Accepted Answer

The RSPAN VLAN is not allowed on the trunk between the source and destination switches.. RSPAN requires a dedicated VLAN (RSPAN VLAN) that is trunked across the network. If the RSPAN VLAN is not allowed on the trunk, traffic fails to reach the destination. If the destination switch does not have the RSPAN VLAN configured, the session cannot receive traffic. A missing 'monitor session' command on the source switch means no traffic is being captured. A native VLAN mismatch does not specifically affect RSPAN, and a routing protocol issue is not directly related to Layer 2 RSPAN.

Answer

The native VLAN mismatch on the trunk link.

Answer

The routing protocol is not redistributing the RSPAN VLAN.

Question 15

Which TWO configuration steps are required to set up an ERSPAN session on a Cisco IOS-XE device? (Choose TWO.)

Accepted Answer

monitor session 1 type erspan-source. ERSPAN encapsulates monitored traffic in GRE and sends it to an IP destination. The 'monitor session 1 type erspan-source' command defines the session as an ERSPAN source. The 'destination' command under that session specifies the IP address of the destination. 'source' is also needed but is not listed as an option here; 'shutdown' disables the session, 'no monitor session' removes it, and 'ip route' is for routing, not ERSPAN configuration.

Answer

shutdown

Answer

no monitor session 1

Answer

ip route 192.168.1.0 255.255.255.0 GigabitEthernet0/1