350-401 Practice Test 33 — 15 Questions

Question 1

An engineer is configuring SPAN on a Cisco Catalyst 3850 switch to monitor traffic from a trunk port (Gi1/0/1) that carries VLANs 10, 20, and 30. The monitoring station is on port Gi1/0/24. The engineer wants to capture only VLAN 20 traffic from the trunk. Which configuration should the engineer use?

Accepted Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 20'.. To capture traffic from a specific VLAN on a trunk port, the engineer must use the 'filter vlan' option in the SPAN session. The correct answer is to configure 'monitor session 1 source interface Gi1/0/1 both' and then 'monitor session 1 filter vlan 20'. Option B is incorrect because it captures all VLANs. Option C is incorrect because VLAN-based SPAN would capture all traffic on VLAN 20 from all ports, not just the trunk. Option D is incorrect because it captures only VLAN 20 but from all ports.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 10,30'.

Question 2

A network engineer runs the following command on Switch SW4:

SW4# show monitor session 4
Session 4
---------
Type                   : Local Session
Source VLANs           :
    RX Only            : 10,20
Destination Ports     : Gi1/0/25
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

Only incoming traffic on VLANs 10 and 20 is mirrored to Gi1/0/25.. The session is local SPAN with source VLANs 10 and 20, capturing only received traffic (RX Only). The destination port Gi1/0/25 sends out the mirrored traffic with Native encapsulation and ingress disabled. This monitors incoming traffic on those VLANs.

Answer

Both incoming and outgoing traffic on VLANs 10 and 20 are mirrored.

Answer

This is an RSPAN session using VLANs 10 and 20 as remote VLANs.

Answer

The destination port Gi1/0/25 is configured to receive mirrored traffic.

Question 3

A network engineer runs the following command on Switch SW8:

SW8# show monitor session 8
Session 8
---------
Type                   : Remote Source Session
Source VLANs           :
    Both               : 30
Destination Ports     : Gi1/0/30
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

All traffic on VLAN 30 is mirrored and sent to a remote VLAN via Gi1/0/30.. This is an RSPAN source session with source VLAN 30 capturing both directions. The destination port Gi1/0/30 uses Replicate encapsulation to send mirrored traffic to a remote VLAN. This is typical for an RSPAN source switch.

Answer

This is a local SPAN session that monitors VLAN 30.

Answer

Only received traffic on VLAN 30 is captured.

Answer

The destination port Gi1/0/30 is used to receive mirrored traffic.

Question 4

An engineer is configuring RSPAN to monitor traffic from multiple switches in a data center. The monitoring station is connected to a central switch. The engineer has configured an RSPAN VLAN (VLAN 999) on all switches and set up the source sessions on the remote switches. However, the monitoring station receives no traffic. On the central switch, the engineer verifies that the RSPAN VLAN is active and that the destination session is configured. What is a likely missing configuration?

Accepted Answer

The trunk ports between the switches do not have the RSPAN VLAN (999) in their allowed VLAN list.. For RSPAN to work, the RSPAN VLAN must be allowed on all trunk links between the source switches and the destination switch. If the trunk ports do not have the RSPAN VLAN in their allowed list, the traffic will be dropped. Also, the RSPAN VLAN must not be pruned by VTP. The correct answer is that the trunk ports between the switches are not configured to allow the RSPAN VLAN. Option B is incorrect because the destination session is already configured. Option C is incorrect because the source session is already configured. Option D is incorrect because the RSPAN VLAN is active.

Answer

The destination session on the central switch is configured with 'monitor session 2 destination remote vlan 999' instead of 'monitor session 2 destination interface Gi1/0/1'.

Answer

The source sessions on the remote switches are configured with 'monitor session 1 source vlan 100' but the destination is not set to 'remote vlan 999'.

Answer

The RSPAN VLAN is not created as a remote SPAN VLAN; it must be configured with 'remote-span' command.

Question 5

A network engineer is troubleshooting a security issue and needs to capture all traffic between two servers connected to different switches. The switches are connected via a trunk link. The monitoring station is connected to a third switch. The engineer decides to use RSPAN. Which of the following is a mandatory requirement for RSPAN to function correctly?

Accepted Answer

The RSPAN VLAN must be configured with the 'remote-span' command on all switches.. RSPAN requires a dedicated VLAN (RSPAN VLAN) that is used to transport the mirrored traffic from source switches to the destination switch. This VLAN must be configured with the 'remote-span' command on all switches that participate. The correct answer is that the RSPAN VLAN must be configured with the 'remote-span' command. Option A is incorrect because the RSPAN VLAN does not need to be the native VLAN. Option B is incorrect because the RSPAN VLAN does not need to be pruned; in fact, it must be allowed on all trunks. Option D is incorrect because the RSPAN VLAN must be consistent across all switches, but it is not required to be the management VLAN.

Answer

The RSPAN VLAN must be configured as the native VLAN on all trunk ports.

Answer

The RSPAN VLAN must be pruned from all trunk ports to prevent loops.

Answer

The RSPAN VLAN must be the same as the management VLAN for the switches.

Question 6

A network engineer runs the following command on Switch SW1:

SW1# show monitor session 1
Session 1
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
    Both               : Gi1/0/2
Destination Ports     : Gi1/0/10
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

Traffic from Gi1/0/1 and Gi1/0/2 is copied to Gi1/0/10 for monitoring.. The output shows a local SPAN session with source ports Gi1/0/1 and Gi1/0/2 (both directions) and destination port Gi1/0/10. The destination port is set to Native encapsulation, meaning it sends traffic in the original VLAN format. Ingress is disabled, so no incoming traffic on the destination port is forwarded. This is a standard local SPAN configuration.

Answer

This is an RSPAN session that sends traffic to a remote VLAN.

Answer

Ingress traffic on Gi1/0/10 is forwarded to the source ports.

Answer

The destination port is configured to capture only egress traffic.

Question 7

A network engineer runs the following command on Switch SW5:

SW5# show monitor session 5
Session 5
---------
Type                   : Remote Source Session
Source Ports           :
    Both               : Gi1/0/1-3
Destination Ports     : Gi1/0/24
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

Traffic from ports Gi1/0/1-3 is mirrored and sent to a remote VLAN via Gi1/0/24.. This is an RSPAN source session on SW5. Source ports Gi1/0/1-3 capture both directions. The destination port Gi1/0/24 uses Replicate encapsulation, which is typical for RSPAN to send mirrored traffic to a remote VLAN. This switch is the source of the RSPAN session.

Answer

This is a local SPAN session that sends traffic to Gi1/0/24.

Answer

The destination port Gi1/0/24 is used to receive mirrored traffic from another switch.

Answer

Only egress traffic from Gi1/0/1-3 is captured.

Question 8

A network engineer runs the following command on Switch SW9:

SW9# show monitor session 9
Session 9
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 300
Destination Ports      : Gi1/0/40
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

This switch receives mirrored traffic from RSPAN VLAN 300 and sends it to Gi1/0/40.. This is an RSPAN destination session on SW9. The source is RSPAN VLAN 300, and the destination port Gi1/0/40 sends out the mirrored traffic. The destination port has Native encapsulation and ingress disabled, meaning it only forwards traffic from the RSPAN VLAN and does not forward incoming traffic.

Answer

This is a local SPAN session with source VLAN 300.

Answer

The RSPAN VLAN 300 is used to send traffic to a remote switch.

Answer

Ingress traffic on Gi1/0/40 is forwarded to the RSPAN VLAN.

Question 9

A network engineer runs the following command on Switch SW7:

SW7# show monitor session 7
Session 7
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
Destination Ports     : Gi1/0/20
    Encapsulation      : Native
    Ingress            : Enabled

Based on this output, what can be concluded?

Accepted Answer

The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.. This is a local SPAN session with ingress enabled on the destination port. Normally, ingress is disabled to prevent loops, but here it is enabled, meaning traffic arriving on Gi1/0/20 can be forwarded normally. This is unusual and may be used for specific monitoring purposes.

Answer

This is an RSPAN session with a remote VLAN.

Answer

Only egress traffic from Gi1/0/1 is mirrored.

Answer

The destination port is configured to block all incoming traffic.

Question 10

Given the following configuration on a Cisco switch:

monitor session 1 source interface GigabitEthernet1/0/1 - 3 both
monitor session 1 destination interface GigabitEthernet1/0/4

What is the effect of this configuration?

Accepted Answer

Traffic from GigabitEthernet1/0/1, 1/0/2, and 1/0/3 is copied to GigabitEthernet1/0/4.. This configures a SPAN session that monitors multiple source interfaces (GigabitEthernet1/0/1 through 1/0/3) and sends their traffic to a single destination interface (GigabitEthernet1/0/4).

Answer

Only traffic from GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/4.

Answer

Traffic from GigabitEthernet1/0/4 is copied to GigabitEthernet1/0/1, 1/0/2, and 1/0/3.

Answer

The configuration is invalid because a SPAN session can only have one source interface.

Question 11

Which statement about RSPAN is true?

Accepted Answer

RSPAN uses a dedicated VLAN to transport mirrored traffic from source to destination switches.. RSPAN uses a dedicated VLAN to transport mirrored traffic across multiple switches, allowing remote monitoring.

Answer

RSPAN can only monitor traffic within the same switch.

Answer

RSPAN requires the use of ERSPAN encapsulation.

Answer

RSPAN destination ports must be in trunk mode.

Question 12

Drag and drop the steps of troubleshooting a failed RSPAN session into the correct order, from first to last.

Accepted Answer

Verify RSPAN VLAN is created and active. The correct order starts with verifying the RSPAN VLAN exists and is active on all switches, then checking that trunk links carry the RSPAN VLAN, then confirming the source SPAN session is correctly configured, then inspecting the destination SPAN session, and finally using debug or monitor commands to isolate the issue.

Question 13

Given the following configuration snippet on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast

monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination interface GigabitEthernet1/0/2

What is the effect of this configuration?

Accepted Answer

All traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.. The configuration creates a local SPAN session that copies traffic from GigabitEthernet1/0/1 (both ingress and egress) to GigabitEthernet1/0/2, which is a standard SPAN destination port.

Answer

Only traffic entering GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.

Answer

Traffic on GigabitEthernet1/0/2 is replicated to GigabitEthernet1/0/1.

Answer

The configuration is invalid because the destination port must be in trunk mode.

Question 14

Examine the following RSPAN configuration on a Cisco switch:

vlan 200
 name RSPAN_VLAN
 remote-span

monitor session 3 source interface GigabitEthernet1/0/5 both
monitor session 3 destination remote vlan 200

interface GigabitEthernet1/0/10
 switchport mode trunk
 switchport trunk allowed vlan 200

What is missing for RSPAN to function correctly across multiple switches?

Accepted Answer

The RSPAN VLAN 200 must be created on all switches that will forward the mirrored traffic.. For RSPAN to work across multiple switches, the RSPAN VLAN must be created on all switches and allowed on trunk links. The configuration shown only creates the VLAN on one switch and allows it on one trunk, but the VLAN must exist on all switches in the path.

Answer

The destination remote vlan 200 command should include 'encapsulation replicate'.

Answer

The source interface must be in trunk mode to monitor VLANs.

Answer

The monitor session number must match on all switches.

Question 15

What is the purpose of the 'encapsulation replicate' keyword in a SPAN destination configuration?

Accepted Answer

It preserves the original VLAN tag of mirrored frames.. The 'encapsulation replicate' keyword ensures that the mirrored traffic retains its original VLAN tag when sent to the destination port, which is useful for monitoring trunk traffic.

Answer

It duplicates the mirrored traffic to multiple destination ports.

Answer

It enables RSPAN functionality.

Answer

It allows the destination port to send traffic as well.