300-410 SPAN, RSPAN, and ERSPAN Practice Test 4 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show monitor session 5 detail
Session 5
---------
Type                   : ERSPAN Destination Session
Source IP              : 10.1.1.2
ERSPAN ID              : 100
Destination Ports      : Gi0/3
    Encapsulation      : Native
    Ingress            : Disabled

What does this output indicate?

Accepted Answer

The session is correctly configured as an ERSPAN destination session.. The output shows an ERSPAN destination session with source IP 10.1.1.2, ERSPAN ID 100, and destination port Gi0/3. This is the destination side of an ERSPAN configuration.

Answer

The session is misconfigured because the source must be a VLAN, not an IP.

Answer

The session is misconfigured because the destination port must have ingress enabled.

Answer

The session is misconfigured because the ERSPAN ID must be different from the source session.

Question 2

A network engineer runs the following command to troubleshoot a SPAN issue:

R1# show monitor session all
Session 1
---------
Type                   : Local Session
Source Ports           : 
    Both               : Gi0/0
Destination Ports      : Gi0/1
    Encapsulation      : Native
    Ingress            : Disabled

Session 2
---------
Type                   : Remote Source Session
Source Ports           : 
    Both               : Gi0/2
Destination RSPAN VLAN : 100

What does this output indicate?

Accepted Answer

Both sessions are correctly configured and can operate simultaneously.. The output shows two sessions: Session 1 is a local SPAN session, and Session 2 is an RSPAN source session. This is a valid configuration for multiple monitoring sessions.

Answer

Session 1 is misconfigured because it cannot coexist with an RSPAN session.

Answer

Session 2 is misconfigured because the RSPAN VLAN must be used only for RSPAN.

Answer

Both sessions are misconfigured because they use the same source port.

Question 3

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show monitor session 6 detail
Session 6
---------
Type                   : ERSPAN Source Session
Source VLANs           : 
    Both               : 10-20
Destination IP         : 10.1.1.3
ERSPAN ID              : 200

What does this output indicate?

Accepted Answer

The session is correctly configured to monitor VLANs 10 through 20.. The output shows an ERSPAN source session with source VLANs 10-20, destination IP 10.1.1.3, and ERSPAN ID 200. This is a valid ERSPAN source session using VLANs as the source.

Answer

The session is misconfigured because ERSPAN cannot use VLANs as source.

Answer

The session is misconfigured because the ERSPAN ID must be less than 100.

Answer

The session is misconfigured because the destination IP must be on the same subnet.

Question 4

A network engineer runs the following command to troubleshoot a SPAN issue:

R1# debug monitor session 1
*Mar  1 00:00:01.123: MONITOR: Session 1: Packet captured on Gi0/0, forwarded to Gi0/1
*Mar  1 00:00:02.456: MONITOR: Session 1: Packet captured on Gi0/0, forwarded to Gi0/1

What does this output indicate?

Accepted Answer

The SPAN session is correctly forwarding packets from Gi0/0 to Gi0/1.. The debug output shows that packets captured on source port Gi0/0 are being forwarded to destination port Gi0/1 for session 1. This indicates that the SPAN session is operational.

Answer

The SPAN session is misconfigured because packets should not be forwarded.

Answer

The SPAN session is misconfigured because the debug output shows errors.

Answer

The SPAN session is misconfigured because the destination port is not specified.

Question 5

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show ip interface brief | include Gi0/0
GigabitEthernet0/0           10.1.1.1       YES NVRAM  up                    up

R1# show monitor session 7 detail
Session 7
---------
Type                   : ERSPAN Source Session
Source Ports           : 
    Both               : Gi0/1
Destination IP         : 10.1.1.2
ERSPAN ID              : 300

What does this output indicate?

Accepted Answer

The ERSPAN session is correctly configured and the destination IP is reachable.. The output shows that interface Gi0/0 has IP address 10.1.1.1 and is up/up, and ERSPAN session 7 has destination IP 10.1.1.2. This indicates that the ERSPAN source session is configured to send traffic to 10.1.1.2, which is reachable via Gi0/0.

Answer

The ERSPAN session is misconfigured because the source port must have an IP address.

Answer

The ERSPAN session is misconfigured because the destination IP must be on the same subnet as the source.

Answer

The ERSPAN session is misconfigured because the ERSPAN ID must be unique across all sessions.

Question 6

What is the default ERSPAN encapsulation type on Cisco IOS-XE devices?

Accepted Answer

ERSPAN Type II. ERSPAN defaults to Type II encapsulation, which uses a 4-byte GRE header with a 4-byte ERSPAN header (8 bytes total). Type III is optional and requires explicit configuration.

Answer

ERSPAN Type I

Answer

ERSPAN Type III

Answer

ERSPAN Type IV

Question 7

Which statement about the SPAN destination port behavior is correct?

Accepted Answer

The SPAN destination port is automatically placed in a forwarding state and does not run STP.. By default, a SPAN destination port does not participate in any Layer 2 protocols (like STP, CDP, DTP) and does not forward or receive normal traffic; it only transmits mirrored packets.

Answer

The SPAN destination port operates in full-duplex mode by default.

Answer

The SPAN destination port can participate in Spanning Tree Protocol (STP) if configured.

Answer

The SPAN destination port can be used as a normal switch port after removing the SPAN configuration.

Question 8

What is the maximum number of source ports that can be monitored in a single SPAN session on a typical Cisco Catalyst switch?

Accepted Answer

64. A single SPAN session can monitor up to 64 source ports (or source VLANs, but not both in the same session). This is a hardware limitation on most Catalyst switches.

Answer

16

Answer

32

Answer

128

Question 9

Which statement about RSPAN VLAN is correct?

Accepted Answer

The RSPAN VLAN must be configured with the 'remote-span' command on all switches in the network.. An RSPAN VLAN is a dedicated VLAN used to carry mirrored traffic from source switches to a destination switch. It must be configured as a remote-span VLAN, and no end devices should be connected to it.

Answer

The RSPAN VLAN must be the same as the native VLAN on the trunk.

Answer

The RSPAN VLAN can be used for normal user traffic if needed.

Answer

The RSPAN VLAN must be pruned from all trunk links to avoid unnecessary flooding.

Question 10

What is the default ERSPAN ID range on Cisco IOS-XE devices?

Accepted Answer

1 to 1023. ERSPAN sessions use an ID from 1 to 1023 (or 1 to 256 on some platforms) to identify the session. The default is 1 if not specified.

Answer

1 to 256

Answer

1 to 4096

Answer

1 to 65535

Question 11

Which of the following is true about the SPAN source interface configuration?

Accepted Answer

By default, only ingress traffic is monitored.. A SPAN source interface can be configured to monitor both ingress and egress traffic, or either direction. By default, only ingress traffic is monitored if no direction is specified.

Answer

By default, both ingress and egress traffic are monitored.

Answer

By default, only egress traffic is monitored.

Answer

The direction must always be specified; there is no default.

Question 12

What is the maximum number of ERSPAN sessions that can be configured on a Cisco IOS-XE router?

Accepted Answer

24. The maximum number of ERSPAN sessions is platform-dependent, but typically up to 24 sessions on high-end routers like ASR1000 series. This is a hardware/software limitation.

Answer

4

Answer

8

Answer

64

Question 13

Which statement about RSPAN source session is correct?

Accepted Answer

The RSPAN source session must specify a destination RSPAN VLAN.. An RSPAN source session mirrors traffic from source ports to an RSPAN VLAN. The source session can monitor a single VLAN or a set of ports, but not both in the same session. The destination is always the RSPAN VLAN.

Answer

The RSPAN source session can send mirrored traffic to multiple RSPAN VLANs simultaneously.

Answer

The RSPAN source session can monitor both a VLAN and individual ports at the same time.

Answer

The RSPAN source session can use a physical interface as a destination instead of a VLAN.

Question 14

What is the default MTU size for ERSPAN encapsulated packets on Cisco IOS-XE?

Accepted Answer

The ERSPAN packet inherits the interface MTU, with no separate default.. ERSPAN adds a GRE header (4 bytes) and an ERSPAN header (4 bytes for Type II) to the original packet. The default system MTU is 1500 bytes, but the ERSPAN packet may exceed this; however, the default MTU for the ERSPAN session itself is not explicitly set—it inherits the interface MTU. There is no separate default ERSPAN MTU; the question tests understanding that ERSPAN adds 8 bytes overhead.

Answer

1500 bytes

Answer

1492 bytes

Answer

The default ERSPAN MTU is 1518 bytes.

Question 15

Drag and drop the steps to configure an ERSPAN session for remote traffic capture into the correct order, from first to last.

Accepted Answer

Configure source interface and direction. First, you must define the source interface and traffic direction. Next, specify the ERSPAN ID and destination IP address. Then, configure the ERSPAN origin IP address on the source switch. After that, enable the ERSPAN session globally. Finally, verify the session is active.