350-401 SPAN and RSPAN Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Switch SW7:

SW7# show monitor session 7
Session 7
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
Destination Ports     : Gi1/0/20
    Encapsulation      : Native
    Ingress            : Enabled

Based on this output, what can be concluded?

Accepted Answer

The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.. This is a local SPAN session with ingress enabled on the destination port. Normally, ingress is disabled to prevent loops, but here it is enabled, meaning traffic arriving on Gi1/0/20 can be forwarded normally. This is unusual and may be used for specific monitoring purposes.

Answer

This is an RSPAN session with a remote VLAN.

Answer

Only egress traffic from Gi1/0/1 is mirrored.

Answer

The destination port is configured to block all incoming traffic.

Question 2

A network engineer runs the following command on Switch SW8:

SW8# show monitor session 8
Session 8
---------
Type                   : Remote Source Session
Source VLANs           :
    Both               : 30
Destination Ports     : Gi1/0/30
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

All traffic on VLAN 30 is mirrored and sent to a remote VLAN via Gi1/0/30.. This is an RSPAN source session with source VLAN 30 capturing both directions. The destination port Gi1/0/30 uses Replicate encapsulation to send mirrored traffic to a remote VLAN. This is typical for an RSPAN source switch.

Answer

This is a local SPAN session that monitors VLAN 30.

Answer

Only received traffic on VLAN 30 is captured.

Answer

The destination port Gi1/0/30 is used to receive mirrored traffic.

Question 3

A network engineer runs the following command on Switch SW9:

SW9# show monitor session 9
Session 9
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 300
Destination Ports      : Gi1/0/40
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

This switch receives mirrored traffic from RSPAN VLAN 300 and sends it to Gi1/0/40.. This is an RSPAN destination session on SW9. The source is RSPAN VLAN 300, and the destination port Gi1/0/40 sends out the mirrored traffic. The destination port has Native encapsulation and ingress disabled, meaning it only forwards traffic from the RSPAN VLAN and does not forward incoming traffic.

Answer

This is a local SPAN session with source VLAN 300.

Answer

The RSPAN VLAN 300 is used to send traffic to a remote switch.

Answer

Ingress traffic on Gi1/0/40 is forwarded to the RSPAN VLAN.

Question 4

Given the following configuration snippet on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast

monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination interface GigabitEthernet1/0/2

What is the effect of this configuration?

Accepted Answer

All traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.. The configuration creates a local SPAN session that copies traffic from GigabitEthernet1/0/1 (both ingress and egress) to GigabitEthernet1/0/2, which is a standard SPAN destination port.

Answer

Only traffic entering GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.

Answer

Traffic on GigabitEthernet1/0/2 is replicated to GigabitEthernet1/0/1.

Answer

The configuration is invalid because the destination port must be in trunk mode.

Question 5

Examine the following RSPAN configuration on a Cisco Catalyst switch:

vlan 100
 name RSPAN_VLAN
 remote-span

monitor session 1 source vlan 10 both
monitor session 1 destination remote vlan 100

Which statement about this configuration is true?

Accepted Answer

The RSPAN VLAN 100 must be created on all switches in the network that participate in RSPAN.. This configures an RSPAN session where traffic from VLAN 10 is sent to the RSPAN VLAN 100, which is then transported across the network to other switches.

Answer

The destination remote vlan 100 command is incorrect; it should be 'destination remote vlan 100 encapsulation replicate'.

Answer

This configuration copies traffic from VLAN 10 to the local switch only.

Answer

The RSPAN VLAN 100 must be tagged on all trunk ports between switches.

Question 6

Consider the following SPAN configuration on a Cisco IOS-XE switch:

monitor session 2 source interface GigabitEthernet1/0/3 rx
monitor session 2 destination interface GigabitEthernet1/0/4

What is the effect of this configuration?

Accepted Answer

Only traffic received on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.. This SPAN session captures only ingress traffic (rx) from GigabitEthernet1/0/3 and sends it to GigabitEthernet1/0/4.

Answer

Both ingress and egress traffic on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.

Answer

Traffic on GigabitEthernet1/0/4 is mirrored to GigabitEthernet1/0/3.

Answer

The configuration is invalid because the destination interface must be in trunk mode.

Question 7

Given the following configuration on a Cisco switch:

monitor session 1 source interface GigabitEthernet1/0/1 - 3 both
monitor session 1 destination interface GigabitEthernet1/0/4

What is the effect of this configuration?

Accepted Answer

Traffic from GigabitEthernet1/0/1, 1/0/2, and 1/0/3 is copied to GigabitEthernet1/0/4.. This configures a SPAN session that monitors multiple source interfaces (GigabitEthernet1/0/1 through 1/0/3) and sends their traffic to a single destination interface (GigabitEthernet1/0/4).

Answer

Only traffic from GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/4.

Answer

Traffic from GigabitEthernet1/0/4 is copied to GigabitEthernet1/0/1, 1/0/2, and 1/0/3.

Answer

The configuration is invalid because a SPAN session can only have one source interface.

Question 8

Examine the following RSPAN configuration on a Cisco switch:

vlan 200
 name RSPAN_VLAN
 remote-span

monitor session 3 source interface GigabitEthernet1/0/5 both
monitor session 3 destination remote vlan 200

interface GigabitEthernet1/0/10
 switchport mode trunk
 switchport trunk allowed vlan 200

What is missing for RSPAN to function correctly across multiple switches?

Accepted Answer

The RSPAN VLAN 200 must be created on all switches that will forward the mirrored traffic.. For RSPAN to work across multiple switches, the RSPAN VLAN must be created on all switches and allowed on trunk links. The configuration shown only creates the VLAN on one switch and allows it on one trunk, but the VLAN must exist on all switches in the path.

Answer

The destination remote vlan 200 command should include 'encapsulation replicate'.

Answer

The source interface must be in trunk mode to monitor VLANs.

Answer

The monitor session number must match on all switches.

Question 9

Given the following SPAN configuration on a Cisco IOS-XE switch:

monitor session 4 source interface GigabitEthernet1/0/6 tx
monitor session 4 destination interface GigabitEthernet1/0/7

What does this configuration do?

Accepted Answer

Only traffic transmitted from GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.. This SPAN session captures only egress traffic (tx) from GigabitEthernet1/0/6 and sends it to GigabitEthernet1/0/7.

Answer

Both ingress and egress traffic on GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.

Answer

Traffic on GigabitEthernet1/0/7 is mirrored to GigabitEthernet1/0/6.

Answer

The configuration is invalid because the destination interface must be in the same VLAN as the source.

Question 10

What is the maximum number of SPAN sessions that can be configured on a Cisco Catalyst 9300 switch?

Accepted Answer

34. The Cisco Catalyst 9300 switch supports up to 34 SPAN sessions (including local SPAN, RSPAN, and ERSPAN).

Answer

16

Answer

64

Answer

8

Question 11

Which statement about RSPAN is true?

Accepted Answer

RSPAN uses a dedicated VLAN to transport mirrored traffic from source to destination switches.. RSPAN uses a dedicated VLAN to transport mirrored traffic across multiple switches, allowing remote monitoring.

Answer

RSPAN can only monitor traffic within the same switch.

Answer

RSPAN requires the use of ERSPAN encapsulation.

Answer

RSPAN destination ports must be in trunk mode.

Question 12

What is the purpose of the 'encapsulation replicate' keyword in a SPAN destination configuration?

Accepted Answer

It preserves the original VLAN tag of mirrored frames.. The 'encapsulation replicate' keyword ensures that the mirrored traffic retains its original VLAN tag when sent to the destination port, which is useful for monitoring trunk traffic.

Answer

It duplicates the mirrored traffic to multiple destination ports.

Answer

It enables RSPAN functionality.

Answer

It allows the destination port to send traffic as well.

Question 13

Drag and drop the steps of RSPAN session configuration and traffic flow into the correct order, from first to last.

Accepted Answer

Create a dedicated RSPAN VLAN on all switches. The correct order starts with creating a dedicated VLAN for RSPAN traffic, then configuring the source switch to monitor traffic and forward it to that VLAN, followed by configuring the intermediate switches to transport the RSPAN VLAN, then configuring the destination switch to receive and analyze the traffic, and finally verifying end-to-end packet flow.

Question 14

Drag and drop the steps of configuring a local SPAN session on a Cisco IOS switch into the correct order, from first to last.

Accepted Answer

Clear any existing SPAN session configuration. The correct order begins with removing any existing SPAN session, then specifying the source interfaces or VLANs to monitor, then defining the destination interface for the analyzer, then optionally enabling encapsulation replication for trunk ports, and finally verifying the session is active.

Question 15

Drag and drop the steps of troubleshooting a failed RSPAN session into the correct order, from first to last.

Accepted Answer

Verify RSPAN VLAN is created and active. The correct order starts with verifying the RSPAN VLAN exists and is active on all switches, then checking that trunk links carry the RSPAN VLAN, then confirming the source SPAN session is correctly configured, then inspecting the destination SPAN session, and finally using debug or monitor commands to isolate the issue.