Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
6Step 6
7Step 7
CCNA Switching and Network Access Practice Question
Drag and drop the following steps into the correct order to capture and analyze traffic on IOS-XE using the embedded packet capture feature, then export to Wireshark to isolate a Layer 2 or Layer 3 fault.
⚠ Common exam trap
Be careful with the order of operations: the buffer must be defined before the capture point, and the capture must be stopped before exporting. Also, remember that these commands are executed in privileged EXEC mode, not global configuration mode.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enter privileged EXEC mode, define the capture buffer, specify the interface and direction, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.
First enter privileged mode, then define the capture buffer, specify the interface and direction, start the capture, stop it after collecting data, export to a .pcap file, then transfer and analyze in Wireshark.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enter privileged EXEC mode, define the capture buffer, specify the interface and direction, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.
Why this is correct
This sequence correctly follows the IOS-XE embedded packet capture workflow: first enter privileged mode, then define a capture buffer with 'monitor capture buffer', specify the interface and direction with 'monitor capture point', start the capture, stop it, export to .pcap, transfer via TFTP/SCP, and analyze in Wireshark.
- ✗
Enter global configuration mode, define the capture buffer, specify the interface and direction, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.
Why it's wrong here
Entering global configuration mode is the first mistake: the 'monitor capture buffer' and 'monitor capture point' commands are privileged EXEC commands, not global configuration commands. They are operational troubleshooting tools that do not persist in running-config and therefore are not entered from 'configure terminal'. You would have to exit back to privileged EXEC to execute them, so the sequence is fundamentally invalid from the start.
- ✗
Enter privileged EXEC mode, specify the interface and direction, define the capture buffer, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.
Why it's wrong here
In the IOS-XE embedded packet capture workflow, the capture buffer must be created before the capture point, because the capture point associates with the buffer as its destination. If you specify the interface and direction first, you have not yet defined a buffer, so the subsequent command to associate the point to the buffer fails due to the undefined buffer name. The buffer is allocated memory, and the point is the traffic selector, so the point cannot be functional until the buffer exists.
- ✗
Enter privileged EXEC mode, define the capture buffer, specify the interface and direction, start the capture, export the capture to a .pcap file, stop the capture, transfer the file, and analyze in Wireshark.
Why it's wrong here
Exporting the capture buffer to a .pcap file while the capture is still running can yield an incomplete or corrupted file, because the buffer may be actively overwriting old frames in a circular fashion. The proper sequence is to stop the capture point first, which freezes the buffer and stabilizes its contents, and then perform the export to a .pcap file. Only after that clean export should you transfer the file to a host for analysis in Wireshark, ensuring the data is a consistent snapshot of the session.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enter privileged EXEC mode, define the capture buffer, specify the interface and direction, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.Correct answer▾
Why this is correct
This sequence correctly follows the IOS-XE embedded packet capture workflow: first enter privileged mode, then define a capture buffer with 'monitor capture buffer', specify the interface and direction with 'monitor capture point', start the capture, stop it, export to .pcap, transfer via TFTP/SCP, and analyze in Wireshark.
✗Enter global configuration mode, define the capture buffer, specify the interface and direction, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that 'monitor capture' commands are not available in global configuration mode; they are privileged EXEC commands.
Why candidates choose this
Candidates might think that because capture involves configuration-like parameters, it should be done in global configuration mode, similar to other features.
✗Enter privileged EXEC mode, specify the interface and direction, define the capture buffer, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the buffer definition must precede the capture point definition; otherwise, the capture point cannot reference the buffer.
Why candidates choose this
Candidates might think the order of defining the buffer and specifying the interface is interchangeable, but the buffer must be created first.
✗Enter privileged EXEC mode, define the capture buffer, specify the interface and direction, start the capture, export the capture to a .pcap file, stop the capture, transfer the file, and analyze in Wireshark.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the 'export' command should be issued after stopping the capture to ensure the data is finalized.
Why candidates choose this
Candidates might think exporting can be done while capturing, similar to how some tools allow live export, but IOS-XE requires stopping first.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Interpreting Packet Capture Output for Layer 2/3 Troubleshooting
Key term
Wireshark
Wireshark is a free, open-source network protocol analyzer that captures and inspects data packets traveling over a computer network in real time.
Key term
Packet
A packet is a small unit of data that is sent over a network, containing both the actual data and control information for delivery.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.