350-401 SPAN and RSPAN — All Questions With Answers

Question 1

A network engineer is troubleshooting a performance issue between two hosts connected to a Cisco Catalyst 3850 switch. The engineer wants to capture all traffic sent and received by Host A (Gi1/0/1) and send it to a monitoring station connected to Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. However, the monitoring station receives only traffic sent by Host A, not traffic received. What is the most likely cause?

Accepted Answer

The destination port is in the same VLAN as the source interface, causing the switch to drop the copied frames due to loop prevention.. The 'both' keyword should capture both directions, but on some platforms, the destination port must be explicitly configured to allow ingress traffic for received traffic to be copied. The correct answer is that the destination port is not configured with 'monitor session 1 destination interface Gi1/0/24 ingress untagged' or similar, but the question focuses on a common misconfiguration: the destination port is in the same VLAN as the source, causing loops or filtering. Actually, the most common cause is that the source interface is configured as 'both' but the switch does not support egress SPAN on that interface without additional configuration. However, the best answer here is that the source interface is an access port and the destination port is in a different VLAN, and the SPAN session does not copy traffic from the source VLAN. But the scenario says both hosts are in the same VLAN. The correct answer is that the destination port is not configured to allow the SPAN traffic to be sent out; actually, the issue is that the destination port is in the same VLAN as the source, and the switch may drop the copied frames due to loop prevention. The most accurate answer: The engineer must ensure the destination port is not in the same VLAN as the source, or use a remote SPAN (RSPAN) VLAN. But the question asks for the cause. The cause is that the destination port is in the same VLAN as the source, and the switch's loop detection drops the copied frames. So the correct answer is that the destination port is in the same VLAN as the source interface, causing the switch to drop the replicated traffic.

Answer

The source interface is configured as an access port, and the SPAN session cannot capture both directions on an access port.

Answer

The 'monitor session 1 destination interface Gi1/0/24' command does not support egress SPAN; only ingress SPAN is allowed.

Answer

The engineer must also configure 'monitor session 1 filter ip' to capture both directions.

Question 2

A network engineer needs to monitor traffic between two VLANs on a Cisco Catalyst 9300 switch. The engineer wants to capture all packets that traverse the switch between VLAN 10 and VLAN 20. The monitoring station is connected to port Gi1/0/24. Which configuration should the engineer use to capture this inter-VLAN traffic?

Accepted Answer

Configure 'monitor session 1 source vlan 10 - 20 both' and 'monitor session 1 destination interface Gi1/0/24'.. Inter-VLAN traffic is routed by the switch's Layer 3 engine. To capture it, the engineer must use a SPAN session that sources from the VLANs themselves (VLAN-based SPAN) or from the SVI. The correct answer is to configure a SPAN session with source VLANs 10 and 20, and destination interface Gi1/0/24. This captures all traffic entering or leaving those VLANs, including routed traffic. Option A is incorrect because interface SPAN would only capture traffic on that specific port, not all inter-VLAN traffic. Option C is incorrect because RSPAN is for remote monitoring, not needed here. Option D is incorrect because ERSPAN is for encapsulated remote SPAN over IP, not needed.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure an RSPAN VLAN and use 'monitor session 1 source vlan 10 - 20' and 'monitor session 1 destination remote vlan 100'.

Answer

Configure an ERSPAN session with source IP and destination IP.

Question 3

An engineer is configuring RSPAN to monitor traffic from multiple switches in a data center. The monitoring station is connected to a central switch. The engineer has configured an RSPAN VLAN (VLAN 999) on all switches and set up the source sessions on the remote switches. However, the monitoring station receives no traffic. On the central switch, the engineer verifies that the RSPAN VLAN is active and that the destination session is configured. What is a likely missing configuration?

Accepted Answer

The trunk ports between the switches do not have the RSPAN VLAN (999) in their allowed VLAN list.. For RSPAN to work, the RSPAN VLAN must be allowed on all trunk links between the source switches and the destination switch. If the trunk ports do not have the RSPAN VLAN in their allowed list, the traffic will be dropped. Also, the RSPAN VLAN must not be pruned by VTP. The correct answer is that the trunk ports between the switches are not configured to allow the RSPAN VLAN. Option B is incorrect because the destination session is already configured. Option C is incorrect because the source session is already configured. Option D is incorrect because the RSPAN VLAN is active.

Answer

The destination session on the central switch is configured with 'monitor session 2 destination remote vlan 999' instead of 'monitor session 2 destination interface Gi1/0/1'.

Answer

The source sessions on the remote switches are configured with 'monitor session 1 source vlan 100' but the destination is not set to 'remote vlan 999'.

Answer

The RSPAN VLAN is not created as a remote SPAN VLAN; it must be configured with 'remote-span' command.

Question 4

A network engineer is using a Cisco Catalyst 3850 switch to monitor traffic from a server connected to port Gi1/0/1. The monitoring station is on port Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. The monitoring station receives traffic, but the engineer notices that the switch CPU utilization is high. What is the most likely cause of the high CPU?

Accepted Answer

The destination port is still a member of a VLAN, and the switch is processing the copied frames as normal traffic, leading to high CPU.. SPAN can cause high CPU if the destination port is not configured with 'ingress' or if the switch is overloaded. However, a common cause is that the destination port is configured to also forward traffic normally (i.e., it is not a dedicated SPAN destination). But the question says the monitoring station receives traffic, so the destination port is working. High CPU can occur if the SPAN session is configured to capture from a large number of sources or if the switch is processing many packets. The most likely cause here is that the destination port is not configured with 'switchport nonegotiate' or is in a VLAN that causes the switch to process the copied frames as normal traffic, leading to high CPU. But the best answer: The destination port should be configured as a SPAN destination only, and if it is also a member of a VLAN, the switch may try to switch the copied frames, causing high CPU. The correct answer is that the destination port is not configured as a SPAN destination-only port; it is still a member of a VLAN, causing the switch to process the copied frames as normal traffic.

Answer

The SPAN session is capturing both directions, which doubles the number of packets and increases CPU usage.

Answer

The destination port is not configured with 'switchport nonegotiate' and is still participating in DTP, causing CPU overhead.

Answer

The source interface is a trunk port, and SPAN is capturing all VLANs, causing high CPU.

Question 5

A network engineer needs to monitor traffic from a specific VLAN (VLAN 100) on a Cisco Catalyst 9300 switch and send the mirrored traffic to a monitoring station on a different switch across a routed network. The engineer decides to use ERSPAN. Which configuration is required on the source switch?

Accepted Answer

Configure 'monitor session 1 type erspan-source' and then 'source vlan 100' and 'destination ip 192.168.1.100'.. ERSPAN encapsulates mirrored traffic in GRE and sends it over IP. On the source switch, the engineer must configure an ERSPAN source session that specifies the source VLAN and the destination IP address of the monitoring station or the destination switch. The correct answer is to configure 'monitor session 1 type erspan-source' and then specify the source VLAN and the destination IP. Option B is incorrect because that is for local SPAN. Option C is incorrect because that is for RSPAN. Option D is incorrect because that is for local SPAN with a VLAN source.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination remote vlan 999'.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24' and then 'monitor session 1 encapsulation replicate'.

Question 6

An engineer is configuring SPAN on a Cisco Catalyst 3850 switch to monitor traffic from a trunk port (Gi1/0/1) that carries VLANs 10, 20, and 30. The monitoring station is on port Gi1/0/24. The engineer wants to capture only VLAN 20 traffic from the trunk. Which configuration should the engineer use?

Accepted Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 20'.. To capture traffic from a specific VLAN on a trunk port, the engineer must use the 'filter vlan' option in the SPAN session. The correct answer is to configure 'monitor session 1 source interface Gi1/0/1 both' and then 'monitor session 1 filter vlan 20'. Option B is incorrect because it captures all VLANs. Option C is incorrect because VLAN-based SPAN would capture all traffic on VLAN 20 from all ports, not just the trunk. Option D is incorrect because it captures only VLAN 20 but from all ports.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 10,30'.

Question 7

A network engineer is troubleshooting a security issue and needs to capture all traffic between two servers connected to different switches. The switches are connected via a trunk link. The monitoring station is connected to a third switch. The engineer decides to use RSPAN. Which of the following is a mandatory requirement for RSPAN to function correctly?

Accepted Answer

The RSPAN VLAN must be configured with the 'remote-span' command on all switches.. RSPAN requires a dedicated VLAN (RSPAN VLAN) that is used to transport the mirrored traffic from source switches to the destination switch. This VLAN must be configured with the 'remote-span' command on all switches that participate. The correct answer is that the RSPAN VLAN must be configured with the 'remote-span' command. Option A is incorrect because the RSPAN VLAN does not need to be the native VLAN. Option B is incorrect because the RSPAN VLAN does not need to be pruned; in fact, it must be allowed on all trunks. Option D is incorrect because the RSPAN VLAN must be consistent across all switches, but it is not required to be the management VLAN.

Answer

The RSPAN VLAN must be configured as the native VLAN on all trunk ports.

Answer

The RSPAN VLAN must be pruned from all trunk ports to prevent loops.

Answer

The RSPAN VLAN must be the same as the management VLAN for the switches.

Question 8

An engineer is configuring SPAN on a Cisco Catalyst 9300 switch to monitor traffic from a port that is part of an EtherChannel (Port-channel 1). The monitoring station is on port Gi1/0/24. Which configuration should the engineer use to capture traffic from the EtherChannel?

Accepted Answer

Configure 'monitor session 1 source interface Port-channel 1 both' and 'monitor session 1 destination interface Gi1/0/24'.. SPAN can source from an EtherChannel interface. The correct answer is to use the port-channel interface as the source. Option B is incorrect because individual member ports cannot be used as SPAN sources if they are part of an EtherChannel; the SPAN session must reference the port-channel. Option C is incorrect because VLAN-based SPAN would capture all traffic on that VLAN, not just the EtherChannel. Option D is incorrect because RSPAN is not needed.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' (where Gi1/0/1 is a member of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 100' (the VLAN of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure an RSPAN VLAN and use 'monitor session 1 source interface Port-channel 1' and 'monitor session 1 destination remote vlan 999'.

Question 9

A network engineer is monitoring traffic from a server connected to a Cisco Catalyst 3850 switch. The engineer configures a SPAN session with source interface Gi1/0/1 and destination interface Gi1/0/24. The monitoring station receives traffic, but the engineer notices that the destination port is not forwarding any normal traffic. What is the most likely reason?

Accepted Answer

The destination port is automatically configured as a SPAN destination port, which disables normal switching on that port.. When a port is configured as a SPAN destination, it stops forwarding normal traffic by default. The port becomes a SPAN-only port. The correct answer is that the destination port is automatically put into a special state where it only sends SPAN traffic and does not forward normal data. Option B is incorrect because the destination port does not need to be in trunk mode. Option C is incorrect because the destination port does not need to be in access mode. Option D is incorrect because the destination port is not disabled; it is active for SPAN.

Answer

The destination port must be configured as a trunk port to forward SPAN traffic.

Answer

The destination port must be configured as an access port to forward SPAN traffic.

Answer

The destination port is in an err-disabled state due to a loop.

Question 10

A network engineer runs the following command on Switch SW1:

SW1# show monitor session 1
Session 1
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
    Both               : Gi1/0/2
Destination Ports     : Gi1/0/10
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

Traffic from Gi1/0/1 and Gi1/0/2 is copied to Gi1/0/10 for monitoring.. The output shows a local SPAN session with source ports Gi1/0/1 and Gi1/0/2 (both directions) and destination port Gi1/0/10. The destination port is set to Native encapsulation, meaning it sends traffic in the original VLAN format. Ingress is disabled, so no incoming traffic on the destination port is forwarded. This is a standard local SPAN configuration.

Answer

This is an RSPAN session that sends traffic to a remote VLAN.

Answer

Ingress traffic on Gi1/0/10 is forwarded to the source ports.

Answer

The destination port is configured to capture only egress traffic.

Question 11

A network engineer runs the following command on Switch SW2:

SW2# show monitor session 2
Session 2
---------
Type                   : Remote Source Session
Source Ports           :
    TX Only            : Gi1/0/5
    RX Only            : Gi1/0/6
Destination Ports     : Gi1/0/20
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

This is an RSPAN source session, sending mirrored traffic to a remote VLAN.. The session type is Remote Source Session, indicating this is an RSPAN source switch. Source port Gi1/0/5 captures only transmitted traffic, and Gi1/0/6 captures only received traffic. The destination port uses Replicate encapsulation, which is typical for RSPAN to send traffic to a remote VLAN. This is part of an RSPAN configuration.

Answer

This is a local SPAN session with bidirectional capture.

Answer

The destination port Gi1/0/20 is used to receive mirrored traffic from another switch.

Answer

Both source ports capture all traffic in both directions.

Question 12

A network engineer runs the following command on Switch SW3:

SW3# show monitor session 3
Session 3
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 100
Destination Ports      : Gi1/0/15
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

This switch receives mirrored traffic from the RSPAN VLAN and sends it to Gi1/0/15.. The session type is Remote Destination Session, which is the destination switch in an RSPAN setup. The source is an RSPAN VLAN (100), and the destination port Gi1/0/15 is used to monitor traffic from that VLAN. The destination port has Native encapsulation and ingress disabled, meaning it only sends out the mirrored traffic from the RSPAN VLAN.

Answer

This is a local SPAN session with source VLAN 100.

Answer

The RSPAN VLAN 100 is used to send traffic to a remote switch.

Answer

Ingress traffic on Gi1/0/15 is forwarded to the RSPAN VLAN.

Question 13

A network engineer runs the following command on Switch SW4:

SW4# show monitor session 4
Session 4
---------
Type                   : Local Session
Source VLANs           :
    RX Only            : 10,20
Destination Ports     : Gi1/0/25
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

Only incoming traffic on VLANs 10 and 20 is mirrored to Gi1/0/25.. The session is local SPAN with source VLANs 10 and 20, capturing only received traffic (RX Only). The destination port Gi1/0/25 sends out the mirrored traffic with Native encapsulation and ingress disabled. This monitors incoming traffic on those VLANs.

Answer

Both incoming and outgoing traffic on VLANs 10 and 20 are mirrored.

Answer

This is an RSPAN session using VLANs 10 and 20 as remote VLANs.

Answer

The destination port Gi1/0/25 is configured to receive mirrored traffic.

Question 14

A network engineer runs the following command on Switch SW5:

SW5# show monitor session 5
Session 5
---------
Type                   : Remote Source Session
Source Ports           :
    Both               : Gi1/0/1-3
Destination Ports     : Gi1/0/24
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

Traffic from ports Gi1/0/1-3 is mirrored and sent to a remote VLAN via Gi1/0/24.. This is an RSPAN source session on SW5. Source ports Gi1/0/1-3 capture both directions. The destination port Gi1/0/24 uses Replicate encapsulation, which is typical for RSPAN to send mirrored traffic to a remote VLAN. This switch is the source of the RSPAN session.

Answer

This is a local SPAN session that sends traffic to Gi1/0/24.

Answer

The destination port Gi1/0/24 is used to receive mirrored traffic from another switch.

Answer

Only egress traffic from Gi1/0/1-3 is captured.

Question 15

A network engineer runs the following command on Switch SW6:

SW6# show monitor session 6
Session 6
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 200
Destination Ports      : Gi1/0/12
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

This switch receives mirrored traffic from RSPAN VLAN 200 and sends it to Gi1/0/12.. This is an RSPAN destination session on SW6. The source is RSPAN VLAN 200, and the destination port Gi1/0/12 sends out the mirrored traffic. The destination port has Native encapsulation and ingress disabled, meaning it only forwards traffic from the RSPAN VLAN.

Answer

This is a local SPAN session with source VLAN 200.

Answer

The RSPAN VLAN 200 is used to send traffic to a remote switch.

Answer

Ingress traffic on Gi1/0/12 is forwarded to the RSPAN VLAN.

Question 16

A network engineer runs the following command on Switch SW7:

SW7# show monitor session 7
Session 7
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
Destination Ports     : Gi1/0/20
    Encapsulation      : Native
    Ingress            : Enabled

Based on this output, what can be concluded?

Accepted Answer

The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.. This is a local SPAN session with ingress enabled on the destination port. Normally, ingress is disabled to prevent loops, but here it is enabled, meaning traffic arriving on Gi1/0/20 can be forwarded normally. This is unusual and may be used for specific monitoring purposes.

Answer

This is an RSPAN session with a remote VLAN.

Answer

Only egress traffic from Gi1/0/1 is mirrored.

Answer

The destination port is configured to block all incoming traffic.

Question 17

A network engineer runs the following command on Switch SW8:

SW8# show monitor session 8
Session 8
---------
Type                   : Remote Source Session
Source VLANs           :
    Both               : 30
Destination Ports     : Gi1/0/30
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

All traffic on VLAN 30 is mirrored and sent to a remote VLAN via Gi1/0/30.. This is an RSPAN source session with source VLAN 30 capturing both directions. The destination port Gi1/0/30 uses Replicate encapsulation to send mirrored traffic to a remote VLAN. This is typical for an RSPAN source switch.

Answer

This is a local SPAN session that monitors VLAN 30.

Answer

Only received traffic on VLAN 30 is captured.

Answer

The destination port Gi1/0/30 is used to receive mirrored traffic.

Question 18

A network engineer runs the following command on Switch SW9:

SW9# show monitor session 9
Session 9
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 300
Destination Ports      : Gi1/0/40
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

This switch receives mirrored traffic from RSPAN VLAN 300 and sends it to Gi1/0/40.. This is an RSPAN destination session on SW9. The source is RSPAN VLAN 300, and the destination port Gi1/0/40 sends out the mirrored traffic. The destination port has Native encapsulation and ingress disabled, meaning it only forwards traffic from the RSPAN VLAN and does not forward incoming traffic.

Answer

This is a local SPAN session with source VLAN 300.

Answer

The RSPAN VLAN 300 is used to send traffic to a remote switch.

Answer

Ingress traffic on Gi1/0/40 is forwarded to the RSPAN VLAN.

Question 19

Given the following configuration snippet on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast

monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination interface GigabitEthernet1/0/2

What is the effect of this configuration?

Accepted Answer

All traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.. The configuration creates a local SPAN session that copies traffic from GigabitEthernet1/0/1 (both ingress and egress) to GigabitEthernet1/0/2, which is a standard SPAN destination port.

Answer

Only traffic entering GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.

Answer

Traffic on GigabitEthernet1/0/2 is replicated to GigabitEthernet1/0/1.

Answer

The configuration is invalid because the destination port must be in trunk mode.

Question 20

Examine the following RSPAN configuration on a Cisco Catalyst switch:

vlan 100
 name RSPAN_VLAN
 remote-span

monitor session 1 source vlan 10 both
monitor session 1 destination remote vlan 100

Which statement about this configuration is true?

Accepted Answer

The RSPAN VLAN 100 must be created on all switches in the network that participate in RSPAN.. This configures an RSPAN session where traffic from VLAN 10 is sent to the RSPAN VLAN 100, which is then transported across the network to other switches.

Answer

The destination remote vlan 100 command is incorrect; it should be 'destination remote vlan 100 encapsulation replicate'.

Answer

This configuration copies traffic from VLAN 10 to the local switch only.

Answer

The RSPAN VLAN 100 must be tagged on all trunk ports between switches.

350-401 SPAN and RSPAN — All Questions With Answers

A network engineer needs to monitor traffic from a specific VLAN (VLAN 100) on a Cisco Catalyst 9300 switch and send the mirrored traffic to a monitoring station on a different switch across a routed network. The engineer decides to use ERSPAN. Which configuration is required on the source switch?

An engineer is configuring SPAN on a Cisco Catalyst 9300 switch to monitor traffic from a port that is part of an EtherChannel (Port-channel 1). The monitoring station is on port Gi1/0/24. Which configuration should the engineer use to capture traffic from the EtherChannel?

What is the maximum number of SPAN sessions that can be configured on a Cisco Catalyst 9300 switch?

Which statement about RSPAN is true?

What is the purpose of the 'encapsulation replicate' keyword in a SPAN destination configuration?

Drag and drop the steps of RSPAN session configuration and traffic flow into the correct order, from first to last.

Drag and drop the steps of configuring a local SPAN session on a Cisco IOS switch into the correct order, from first to last.

Drag and drop the steps of troubleshooting a failed RSPAN session into the correct order, from first to last.

Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.

Drag and drop the steps of Multiple SPAN source ports with filter VLAN into the correct order, from first to last.

Drag and drop the steps of RSPAN VLAN propagation across trunk links into the correct order, from first to last.

Drag and drop the steps of SPAN session on EtherChannel member ports into the correct order, from first to last.

Drag and drop the steps of Embedded Packet Capture (EPC) on IOS-XE steps into the correct order, from first to last.

Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.

Drag and drop the steps of Multiple SPAN source ports with filter VLAN into the correct order, from first to last.

Drag and drop the steps of RSPAN VLAN propagation across trunk links into the correct order, from first to last.

Drag and drop the steps of SPAN session on EtherChannel member ports into the correct order, from first to last.

Drag and drop the steps of Embedded Packet Capture (EPC) on IOS-XE steps into the correct order, from first to last.

Drag and drop each SPAN type on the left to its correct scope description on the right.

Drag and drop each SPAN source type on the left to the traffic it monitors on the right.

Drag and drop each ERSPAN version on the left to its correct header format on the right.

Drag and drop each RSPAN VLAN requirement on the left to its correct restriction on the right.

Drag and drop each traffic direction on the left to the correct SPAN keyword used to monitor it on the right.

Drag and drop each SPAN type on the left to its correct scope description on the right.

Drag and drop each SPAN source type on the left to its correct monitored traffic description on the right.

Drag and drop each ERSPAN version on the left to its correct header format description on the right.

Drag and drop each RSPAN VLAN requirement on the left to its correct restriction on the right.

Drag and drop each traffic direction on the left to its correct SPAN keyword on the right.

Which two statements about local SPAN configuration are true? (Choose two.)

Which three statements about RSPAN are true? (Choose three.)

Which two statements about SPAN and RSPAN configuration limits are true? (Choose two.)

Which three statements about RSPAN configuration and behavior are true? (Choose three.)

Which two statements about SPAN and RSPAN are true? (Choose two.)

Which two statements about configuring SPAN on Cisco IOS-XE switches are true? (Choose two.)

Which three statements about RSPAN are true? (Choose three.)

Which three statements about SPAN and RSPAN limitations are true? (Choose three.)

350-401 SPAN and RSPAN — All Questions With Answers

A network engineer needs to monitor traffic from a specific VLAN (VLAN 100) on a Cisco Catalyst 9300 switch and send the mirrored traffic to a monitoring station on a different switch across a routed network. The engineer decides to use ERSPAN. Which configuration is required on the source switch?

An engineer is configuring SPAN on a Cisco Catalyst 9300 switch to monitor traffic from a port that is part of an EtherChannel (Port-channel 1). The monitoring station is on port Gi1/0/24. Which configuration should the engineer use to capture traffic from the EtherChannel?

What is the maximum number of SPAN sessions that can be configured on a Cisco Catalyst 9300 switch?

Which statement about RSPAN is true?

What is the purpose of the 'encapsulation replicate' keyword in a SPAN destination configuration?

Drag and drop the steps of RSPAN session configuration and traffic flow into the correct order, from first to last.

Drag and drop the steps of configuring a local SPAN session on a Cisco IOS switch into the correct order, from first to last.

Drag and drop the steps of troubleshooting a failed RSPAN session into the correct order, from first to last.

Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.

Drag and drop the steps of Multiple SPAN source ports with filter VLAN into the correct order, from first to last.

Drag and drop the steps of RSPAN VLAN propagation across trunk links into the correct order, from first to last.

Drag and drop the steps of SPAN session on EtherChannel member ports into the correct order, from first to last.

Drag and drop the steps of Embedded Packet Capture (EPC) on IOS-XE steps into the correct order, from first to last.

Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.

Drag and drop the steps of Multiple SPAN source ports with filter VLAN into the correct order, from first to last.

Drag and drop the steps of RSPAN VLAN propagation across trunk links into the correct order, from first to last.

Drag and drop the steps of SPAN session on EtherChannel member ports into the correct order, from first to last.

Drag and drop the steps of Embedded Packet Capture (EPC) on IOS-XE steps into the correct order, from first to last.

Drag and drop each SPAN type on the left to its correct scope description on the right.

Drag and drop each SPAN source type on the left to the traffic it monitors on the right.

Drag and drop each ERSPAN version on the left to its correct header format on the right.

Drag and drop each RSPAN VLAN requirement on the left to its correct restriction on the right.

Drag and drop each traffic direction on the left to the correct SPAN keyword used to monitor it on the right.

Drag and drop each SPAN type on the left to its correct scope description on the right.

Drag and drop each SPAN source type on the left to its correct monitored traffic description on the right.

Drag and drop each ERSPAN version on the left to its correct header format description on the right.

Drag and drop each RSPAN VLAN requirement on the left to its correct restriction on the right.

Drag and drop each traffic direction on the left to its correct SPAN keyword on the right.

Which two statements about local SPAN configuration are true? (Choose two.)

Which three statements about RSPAN are true? (Choose three.)

Which two statements about SPAN and RSPAN configuration limits are true? (Choose two.)

Which three statements about RSPAN configuration and behavior are true? (Choose three.)

Which two statements about SPAN and RSPAN are true? (Choose two.)

Which two statements about configuring SPAN on Cisco IOS-XE switches are true? (Choose two.)

Which three statements about RSPAN are true? (Choose three.)

Which three statements about SPAN and RSPAN limitations are true? (Choose three.)