Courseiva

CCNA SPAN and RSPAN Questions

58 questions · SPAN and RSPAN · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Drag & Dropmedium

Drag and drop the steps of configuring a local SPAN session on a Cisco IOS switch into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order begins with removing any existing SPAN session, then specifying the source interfaces or VLANs to monitor, then defining the destination interface for the analyzer, then optionally enabling encapsulation replication for trunk ports, and finally verifying the session is active.

Practice this question →
2
MCQmedium

Given the following SPAN configuration on a Cisco IOS-XE switch: monitor session 4 source interface GigabitEthernet1/0/6 tx monitor session 4 destination interface GigabitEthernet1/0/7 What does this configuration do?

A.Only traffic transmitted from GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.
B.Both ingress and egress traffic on GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.
C.Traffic on GigabitEthernet1/0/7 is mirrored to GigabitEthernet1/0/6.
D.The configuration is invalid because the destination interface must be in the same VLAN as the source.
AnswerA

The 'tx' keyword specifies egress traffic only.

Why this answer

This SPAN session captures only egress traffic (tx) from GigabitEthernet1/0/6 and sends it to GigabitEthernet1/0/7.

Practice this question →
3
MCQmedium

An engineer is configuring SPAN on a Cisco Catalyst 3850 switch to monitor traffic from a trunk port (Gi1/0/1) that carries VLANs 10, 20, and 30. The monitoring station is on port Gi1/0/24. The engineer wants to capture only VLAN 20 traffic from the trunk. Which configuration should the engineer use?

A.Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 20'.
B.Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.
C.Configure 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface Gi1/0/24'.
D.Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 10,30'.
AnswerA

Correct; the filter vlan option limits the SPAN session to only VLAN 20 traffic on the source interface.

Why this answer

To capture traffic from a specific VLAN on a trunk port, the engineer must use the 'filter vlan' option in the SPAN session. The correct answer is to configure 'monitor session 1 source interface Gi1/0/1 both' and then 'monitor session 1 filter vlan 20'. Option B is incorrect because it captures all VLANs.

Option C is incorrect because VLAN-based SPAN would capture all traffic on VLAN 20 from all ports, not just the trunk. Option D is incorrect because it captures only VLAN 20 but from all ports.

Practice this question →
4
Multi-Selectmedium

Which two statements about local SPAN configuration are true? (Choose two.)

Select 2 answers
A.The SPAN destination port must be in STP forwarding state to forward traffic.
B.A SPAN destination port can also be used as a source port in another SPAN session.
C.A SPAN source can be a single port, a VLAN, or an EtherChannel interface.
D.When a VLAN is configured as a SPAN source, all active ports in that VLAN are monitored.
E.SPAN destination ports participate in Spanning Tree Protocol normally.
AnswersA, D

Correct because the destination port must be forwarding to send the mirrored traffic out.

Why this answer

Local SPAN copies traffic from source ports or VLANs to a destination port on the same switch. The destination port must be in STP forwarding state to forward traffic, but it does not participate in STP for the SPAN session. The source can be a port or VLAN, but not a port-channel interface directly; however, individual member ports can be sources.

The destination port cannot be used as a source port simultaneously.

Practice this question →
5
MCQmedium

What is the purpose of the 'encapsulation replicate' keyword in a SPAN destination configuration?

A.It preserves the original VLAN tag of mirrored frames.
B.It duplicates the mirrored traffic to multiple destination ports.
C.It enables RSPAN functionality.
D.It allows the destination port to send traffic as well.
AnswerA

Without this keyword, the destination port strips the VLAN tag; with it, the tag is preserved.

Why this answer

The 'encapsulation replicate' keyword ensures that the mirrored traffic retains its original VLAN tag when sent to the destination port, which is useful for monitoring trunk traffic.

Practice this question →
6
Drag & Dropmedium

Drag and drop the steps of RSPAN VLAN propagation across trunk links into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The RSPAN VLAN must be created, allowed on trunks, and the remote switch must have the VLAN and monitor session configured.

Practice this question →
7
MCQhard

A network engineer runs the following command on Switch SW7: SW7# show monitor session 7 Session 7 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Destination Ports : Gi1/0/20 Encapsulation : Native Ingress : Enabled Based on this output, what can be concluded?

A.The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.
B.This is an RSPAN session with a remote VLAN.
C.Only egress traffic from Gi1/0/1 is mirrored.
D.The destination port is configured to block all incoming traffic.
AnswerA

Ingress enabled allows the port to forward received traffic.

Why this answer

This is a local SPAN session with ingress enabled on the destination port. Normally, ingress is disabled to prevent loops, but here it is enabled, meaning traffic arriving on Gi1/0/20 can be forwarded normally. This is unusual and may be used for specific monitoring purposes.

Practice this question →
8
MCQmedium

A network engineer runs the following command on Switch SW8: SW8# show monitor session 8 Session 8 --------- Type : Remote Source Session Source VLANs : Both : 30 Destination Ports : Gi1/0/30 Encapsulation : Replicate Based on this output, what can be concluded?

A.All traffic on VLAN 30 is mirrored and sent to a remote VLAN via Gi1/0/30.
B.This is a local SPAN session that monitors VLAN 30.
C.Only received traffic on VLAN 30 is captured.
D.The destination port Gi1/0/30 is used to receive mirrored traffic.
AnswerA

The type 'Remote Source Session' and Replicate encapsulation indicate RSPAN.

Why this answer

This is an RSPAN source session with source VLAN 30 capturing both directions. The destination port Gi1/0/30 uses Replicate encapsulation to send mirrored traffic to a remote VLAN. This is typical for an RSPAN source switch.

Practice this question →
9
Drag & Dropmedium

Drag and drop the steps of SPAN session on EtherChannel member ports into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

When using EtherChannel, the SPAN source must be the port-channel interface, not individual members, to capture all traffic.

Practice this question →
10
Matchingmedium

Drag and drop each SPAN source type on the left to the traffic it monitors on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Monitors all traffic entering or leaving a single physical interface.

Monitors all traffic on all ports belonging to a specific VLAN.

Monitors all traffic on all member links of a port-channel interface.

Monitors traffic sent to or from the switch CPU (e.g., control plane).

Monitors all traffic on a contiguous set of VLANs.

Why these pairings

A source port monitors all traffic on that specific port; a source VLAN monitors all traffic on all ports in that VLAN; an EtherChannel source monitors all traffic on all member links of the EtherChannel.

Practice this question →
11
MCQeasy

What is the maximum number of SPAN sessions that can be configured on a Cisco Catalyst 9300 switch?

A.34
B.16
C.64
D.8
AnswerA

The Catalyst 9300 supports a maximum of 34 SPAN sessions.

Why this answer

The Cisco Catalyst 9300 switch supports up to 34 SPAN sessions (including local SPAN, RSPAN, and ERSPAN).

Practice this question →
12
Multi-Selecthard

Which three statements about RSPAN are true? (Choose three.)

Select 3 answers
A.RSPAN uses a dedicated VLAN that is trunked between switches to carry mirrored traffic.
B.The RSPAN VLAN can also be used for regular user data traffic if needed.
C.The RSPAN VLAN must be allowed on all trunk links between the source and destination switches.
D.The RSPAN destination port can be a regular access port in the RSPAN VLAN.
E.RSPAN requires that all switches in the path support the RSPAN feature.
AnswersA, C, E

Correct because the RSPAN VLAN is a special VLAN used exclusively for transporting mirrored packets across switches.

Why this answer

RSPAN uses a dedicated VLAN to transport mirrored traffic across switches. The RSPAN VLAN must be created on all switches in the path and should not be used for user traffic. Trunk ports carry the RSPAN VLAN, and the destination switch receives the traffic on an RSPAN destination port.

The RSPAN VLAN must not be pruned from trunks.

Practice this question →
13
Matchingmedium

Drag and drop each traffic direction on the left to its correct SPAN keyword on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

rx keyword

tx keyword

both keyword

rx keyword

tx keyword

Why these pairings

Ingress traffic is monitored with the 'monitor session source interface x/x rx' keyword; egress with 'tx'; both directions with 'both'.

Practice this question →
14
MCQmedium

A network engineer is troubleshooting a performance issue between two hosts connected to a Cisco Catalyst 3850 switch. The engineer wants to capture all traffic sent and received by Host A (Gi1/0/1) and send it to a monitoring station connected to Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. However, the monitoring station receives only traffic sent by Host A, not traffic received. What is the most likely cause?

A.The source interface is configured as an access port, and the SPAN session cannot capture both directions on an access port.
B.The destination port is in the same VLAN as the source interface, causing the switch to drop the copied frames due to loop prevention.
C.The 'monitor session 1 destination interface Gi1/0/24' command does not support egress SPAN; only ingress SPAN is allowed.
D.The engineer must also configure 'monitor session 1 filter ip' to capture both directions.
AnswerB

Correct; when the destination port is in the same VLAN as the source, the switch may drop the replicated frames to prevent loops, especially if the destination port is also in the forwarding path.

Why this answer

The 'both' keyword should capture both directions, but on some platforms, the destination port must be explicitly configured to allow ingress traffic for received traffic to be copied. The correct answer is that the destination port is not configured with 'monitor session 1 destination interface Gi1/0/24 ingress untagged' or similar, but the question focuses on a common misconfiguration: the destination port is in the same VLAN as the source, causing loops or filtering. Actually, the most common cause is that the source interface is configured as 'both' but the switch does not support egress SPAN on that interface without additional configuration.

However, the best answer here is that the source interface is an access port and the destination port is in a different VLAN, and the SPAN session does not copy traffic from the source VLAN. But the scenario says both hosts are in the same VLAN. The correct answer is that the destination port is not configured to allow the SPAN traffic to be sent out; actually, the issue is that the destination port is in the same VLAN as the source, and the switch may drop the copied frames due to loop prevention.

The most accurate answer: The engineer must ensure the destination port is not in the same VLAN as the source, or use a remote SPAN (RSPAN) VLAN. But the question asks for the cause. The cause is that the destination port is in the same VLAN as the source, and the switch's loop detection drops the copied frames.

So the correct answer is that the destination port is in the same VLAN as the source interface, causing the switch to drop the replicated traffic.

Practice this question →
15
Matchingmedium

Drag and drop each ERSPAN version on the left to its correct header format description on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

4-byte GRE header with 4-byte session ID

4-byte GRE header with 8-byte ERSPAN header

4-byte GRE header with 12-byte ERSPAN header

Indicates ERSPAN encapsulated packet

Optionally included in ERSPAN Type II/III

Why these pairings

ERSPAN Type I uses a 4-byte GRE header with 4-byte session ID; ERSPAN Type II uses a 4-byte GRE header with an 8-byte ERSPAN header; ERSPAN Type III uses a 4-byte GRE header with a 12-byte ERSPAN header.

Practice this question →
16
Matchingmedium

Drag and drop each RSPAN VLAN requirement on the left to its correct restriction on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Must be dedicated solely to RSPAN traffic; no other traffic allowed.

The RSPAN VLAN cannot be the native VLAN of any trunk port.

The RSPAN VLAN must be allowed on all trunk links between source and destination switches.

The RSPAN VLAN must not have an SVI or any Layer 3 interface configured.

RSPAN VLANs are not propagated by VTP; they must be manually created on each switch.

Why these pairings

The RSPAN VLAN must be dedicated to RSPAN only, cannot be the native VLAN, must be allowed on all trunk links between source and destination switches, and must not have any Layer 3 interface configured.

Practice this question →
17
MCQmedium

Which statement about RSPAN is true?

A.RSPAN uses a dedicated VLAN to transport mirrored traffic from source to destination switches.
B.RSPAN can only monitor traffic within the same switch.
C.RSPAN requires the use of ERSPAN encapsulation.
D.RSPAN destination ports must be in trunk mode.
AnswerA

The RSPAN VLAN is used to carry mirrored traffic across the network.

Why this answer

RSPAN uses a dedicated VLAN to transport mirrored traffic across multiple switches, allowing remote monitoring.

Practice this question →
18
MCQmedium

A network engineer runs the following command on Switch SW2: SW2# show monitor session 2 Session 2 --------- Type : Remote Source Session Source Ports : TX Only : Gi1/0/5 RX Only : Gi1/0/6 Destination Ports : Gi1/0/20 Encapsulation : Replicate Based on this output, what can be concluded?

A.This is an RSPAN source session, sending mirrored traffic to a remote VLAN.
B.This is a local SPAN session with bidirectional capture.
C.The destination port Gi1/0/20 is used to receive mirrored traffic from another switch.
D.Both source ports capture all traffic in both directions.
AnswerA

The type 'Remote Source Session' and Replicate encapsulation indicate RSPAN.

Why this answer

The session type is Remote Source Session, indicating this is an RSPAN source switch. Source port Gi1/0/5 captures only transmitted traffic, and Gi1/0/6 captures only received traffic. The destination port uses Replicate encapsulation, which is typical for RSPAN to send traffic to a remote VLAN.

This is part of an RSPAN configuration.

Practice this question →
19
MCQhard

A network engineer runs the following command on Switch SW5: SW5# show monitor session 5 Session 5 --------- Type : Remote Source Session Source Ports : Both : Gi1/0/1-3 Destination Ports : Gi1/0/24 Encapsulation : Replicate Based on this output, what can be concluded?

A.Traffic from ports Gi1/0/1-3 is mirrored and sent to a remote VLAN via Gi1/0/24.
B.This is a local SPAN session that sends traffic to Gi1/0/24.
C.The destination port Gi1/0/24 is used to receive mirrored traffic from another switch.
D.Only egress traffic from Gi1/0/1-3 is captured.
AnswerA

The type 'Remote Source Session' and Replicate encapsulation indicate RSPAN source.

Why this answer

This is an RSPAN source session on SW5. Source ports Gi1/0/1-3 capture both directions. The destination port Gi1/0/24 uses Replicate encapsulation, which is typical for RSPAN to send mirrored traffic to a remote VLAN.

This switch is the source of the RSPAN session.

Practice this question →
20
Drag & Dropmedium

Drag and drop the steps of Embedded Packet Capture (EPC) on IOS-XE steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

EPC requires defining a capture buffer, defining a capture point, associating them, starting the capture, and then stopping/exporting.

Practice this question →
21
MCQhard

A network engineer needs to monitor traffic between two VLANs on a Cisco Catalyst 9300 switch. The engineer wants to capture all packets that traverse the switch between VLAN 10 and VLAN 20. The monitoring station is connected to port Gi1/0/24. Which configuration should the engineer use to capture this inter-VLAN traffic?

A.Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.
B.Configure 'monitor session 1 source vlan 10 - 20 both' and 'monitor session 1 destination interface Gi1/0/24'.
C.Configure an RSPAN VLAN and use 'monitor session 1 source vlan 10 - 20' and 'monitor session 1 destination remote vlan 100'.
D.Configure an ERSPAN session with source IP and destination IP.
AnswerB

Correct; VLAN-based SPAN captures all traffic entering or leaving the specified VLANs, including routed traffic between them.

Why this answer

Inter-VLAN traffic is routed by the switch's Layer 3 engine. To capture it, the engineer must use a SPAN session that sources from the VLANs themselves (VLAN-based SPAN) or from the SVI. The correct answer is to configure a SPAN session with source VLANs 10 and 20, and destination interface Gi1/0/24.

This captures all traffic entering or leaving those VLANs, including routed traffic. Option A is incorrect because interface SPAN would only capture traffic on that specific port, not all inter-VLAN traffic. Option C is incorrect because RSPAN is for remote monitoring, not needed here.

Option D is incorrect because ERSPAN is for encapsulated remote SPAN over IP, not needed.

Practice this question →
22
Multi-Selectmedium

Which two statements about SPAN and RSPAN are true? (Choose two.)

Select 2 answers
A.SPAN mirrors traffic only on the local switch.
B.RSPAN uses a dedicated VLAN to transport mirrored traffic across multiple switches.
C.SPAN can be used to mirror traffic between switches without additional configuration.
D.RSPAN supports both ingress and egress mirroring on the source switch.
E.RSPAN requires a separate management VLAN to function.
AnswersA, B

Correct because SPAN is local to the switch where the source ports reside.

Why this answer

SPAN mirrors traffic locally on the same switch; RSPAN uses a dedicated VLAN to carry mirrored traffic across switches. SPAN can monitor both ingress and egress traffic. RSPAN does not support egress-only mirroring on the source switch; it requires a special VLAN.

SPAN cannot be used across switches without RSPAN or ERSPAN. RSPAN does not require a separate management VLAN.

Practice this question →
23
MCQmedium

Examine the following RSPAN configuration on a Cisco Catalyst switch: vlan 100 name RSPAN_VLAN remote-span monitor session 1 source vlan 10 both monitor session 1 destination remote vlan 100 Which statement about this configuration is true?

A.The RSPAN VLAN 100 must be created on all switches in the network that participate in RSPAN.
B.The destination remote vlan 100 command is incorrect; it should be 'destination remote vlan 100 encapsulation replicate'.
C.This configuration copies traffic from VLAN 10 to the local switch only.
D.The RSPAN VLAN 100 must be tagged on all trunk ports between switches.
AnswerA

For RSPAN to work, the RSPAN VLAN must exist on all switches that forward the mirrored traffic.

Why this answer

This configures an RSPAN session where traffic from VLAN 10 is sent to the RSPAN VLAN 100, which is then transported across the network to other switches.

Practice this question →
24
MCQmedium

Given the following configuration snippet on a Cisco IOS-XE switch: interface GigabitEthernet1/0/1 switchport mode access switchport access vlan 10 spanning-tree portfast monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination interface GigabitEthernet1/0/2 What is the effect of this configuration?

A.All traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.
B.Only traffic entering GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.
C.Traffic on GigabitEthernet1/0/2 is replicated to GigabitEthernet1/0/1.
D.The configuration is invalid because the destination port must be in trunk mode.
AnswerA

The 'both' keyword copies both ingress and egress traffic from the source interface to the destination.

Why this answer

The configuration creates a local SPAN session that copies traffic from GigabitEthernet1/0/1 (both ingress and egress) to GigabitEthernet1/0/2, which is a standard SPAN destination port.

Practice this question →
25
MCQmedium

A network engineer is using a Cisco Catalyst 3850 switch to monitor traffic from a server connected to port Gi1/0/1. The monitoring station is on port Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. The monitoring station receives traffic, but the engineer notices that the switch CPU utilization is high. What is the most likely cause of the high CPU?

A.The SPAN session is capturing both directions, which doubles the number of packets and increases CPU usage.
B.The destination port is not configured with 'switchport nonegotiate' and is still participating in DTP, causing CPU overhead.
C.The destination port is still a member of a VLAN, and the switch is processing the copied frames as normal traffic, leading to high CPU.
D.The source interface is a trunk port, and SPAN is capturing all VLANs, causing high CPU.
AnswerC

Correct; when a destination port is not dedicated to SPAN, the switch may attempt to switch the copied frames, increasing CPU load.

Why this answer

SPAN can cause high CPU if the destination port is not configured with 'ingress' or if the switch is overloaded. However, a common cause is that the destination port is configured to also forward traffic normally (i.e., it is not a dedicated SPAN destination). But the question says the monitoring station receives traffic, so the destination port is working.

High CPU can occur if the SPAN session is configured to capture from a large number of sources or if the switch is processing many packets. The most likely cause here is that the destination port is not configured with 'switchport nonegotiate' or is in a VLAN that causes the switch to process the copied frames as normal traffic, leading to high CPU. But the best answer: The destination port should be configured as a SPAN destination only, and if it is also a member of a VLAN, the switch may try to switch the copied frames, causing high CPU.

The correct answer is that the destination port is not configured as a SPAN destination-only port; it is still a member of a VLAN, causing the switch to process the copied frames as normal traffic.

Practice this question →
26
MCQeasy

A network engineer is monitoring traffic from a server connected to a Cisco Catalyst 3850 switch. The engineer configures a SPAN session with source interface Gi1/0/1 and destination interface Gi1/0/24. The monitoring station receives traffic, but the engineer notices that the destination port is not forwarding any normal traffic. What is the most likely reason?

A.The destination port is automatically configured as a SPAN destination port, which disables normal switching on that port.
B.The destination port must be configured as a trunk port to forward SPAN traffic.
C.The destination port must be configured as an access port to forward SPAN traffic.
D.The destination port is in an err-disabled state due to a loop.
AnswerA

Correct; a SPAN destination port is dedicated to receiving mirrored traffic and does not forward normal traffic.

Why this answer

When a port is configured as a SPAN destination, it stops forwarding normal traffic by default. The port becomes a SPAN-only port. The correct answer is that the destination port is automatically put into a special state where it only sends SPAN traffic and does not forward normal data.

Option B is incorrect because the destination port does not need to be in trunk mode. Option C is incorrect because the destination port does not need to be in access mode. Option D is incorrect because the destination port is not disabled; it is active for SPAN.

Practice this question →
27
MCQmedium

Examine the following RSPAN configuration on a Cisco switch: vlan 200 name RSPAN_VLAN remote-span monitor session 3 source interface GigabitEthernet1/0/5 both monitor session 3 destination remote vlan 200 interface GigabitEthernet1/0/10 switchport mode trunk switchport trunk allowed vlan 200 What is missing for RSPAN to function correctly across multiple switches?

A.The RSPAN VLAN 200 must be created on all switches that will forward the mirrored traffic.
B.The destination remote vlan 200 command should include 'encapsulation replicate'.
C.The source interface must be in trunk mode to monitor VLANs.
D.The monitor session number must match on all switches.
AnswerA

Without the RSPAN VLAN on all switches, the mirrored traffic cannot traverse the network.

Why this answer

For RSPAN to work across multiple switches, the RSPAN VLAN must be created on all switches and allowed on trunk links. The configuration shown only creates the VLAN on one switch and allows it on one trunk, but the VLAN must exist on all switches in the path.

Practice this question →
28
Matchingmedium

Drag and drop each SPAN source type on the left to its correct monitored traffic description on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Monitors traffic on a single physical interface

Monitors all traffic in a specific VLAN

Monitors traffic on a port-channel interface

The port whose traffic is copied

The VLAN whose traffic is copied

Why these pairings

Port SPAN monitors all traffic on a specific port; VLAN SPAN monitors all traffic in a VLAN; EtherChannel SPAN monitors all traffic on a port-channel interface.

Practice this question →
29
MCQmedium

A network engineer runs the following command on Switch SW6: SW6# show monitor session 6 Session 6 --------- Type : Remote Destination Session Source RSPAN VLAN : 200 Destination Ports : Gi1/0/12 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?

A.This switch receives mirrored traffic from RSPAN VLAN 200 and sends it to Gi1/0/12.
B.This is a local SPAN session with source VLAN 200.
C.The RSPAN VLAN 200 is used to send traffic to a remote switch.
D.Ingress traffic on Gi1/0/12 is forwarded to the RSPAN VLAN.
AnswerA

The type 'Remote Destination Session' and source RSPAN VLAN confirm this.

Why this answer

This is an RSPAN destination session on SW6. The source is RSPAN VLAN 200, and the destination port Gi1/0/12 sends out the mirrored traffic. The destination port has Native encapsulation and ingress disabled, meaning it only forwards traffic from the RSPAN VLAN.

Practice this question →
30
Drag & Dropmedium

Drag and drop the steps of Multiple SPAN source ports with filter VLAN into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First specify the session, then add source ports and direction, apply VLAN filter, set destination, and activate the session.

Practice this question →
31
MCQmedium

A network engineer runs the following command on Switch SW1: SW1# show monitor session 1 Session 1 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Both : Gi1/0/2 Destination Ports : Gi1/0/10 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?

A.Traffic from Gi1/0/1 and Gi1/0/2 is copied to Gi1/0/10 for monitoring.
B.This is an RSPAN session that sends traffic to a remote VLAN.
C.Ingress traffic on Gi1/0/10 is forwarded to the source ports.
D.The destination port is configured to capture only egress traffic.
AnswerA

The session type is Local, source ports are in both directions, and destination is Gi1/0/10.

Why this answer

The output shows a local SPAN session with source ports Gi1/0/1 and Gi1/0/2 (both directions) and destination port Gi1/0/10. The destination port is set to Native encapsulation, meaning it sends traffic in the original VLAN format. Ingress is disabled, so no incoming traffic on the destination port is forwarded.

This is a standard local SPAN configuration.

Practice this question →
32
Multi-Selecthard

Which two statements about SPAN and RSPAN configuration limits are true? (Choose two.)

Select 2 answers
A.A single port can be a SPAN source for multiple SPAN sessions simultaneously.
B.A SPAN destination port can be used in multiple SPAN sessions at the same time.
C.RSPAN source sessions and local SPAN sessions count toward the same session limit on a switch.
D.The maximum number of SPAN sessions on a switch is always 4.
E.A SPAN source VLAN can be used in both a local SPAN and an RSPAN session at the same time.
AnswersA, C

Correct because a source port can be monitored by multiple SPAN sessions.

Why this answer

Cisco switches have limits on the number of SPAN/RSPAN sessions, typically up to 2 local SPAN sessions and 1 RSPAN source session. A single port can be a source for multiple sessions, but a destination port can only be used in one session at a time. The source and destination ports must be on the same switch for local SPAN.

Practice this question →
33
Drag & Dropmedium

Drag and drop the steps of Embedded Packet Capture (EPC) on IOS-XE steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

EPC requires defining a capture buffer, then a capture point, associating them, starting the capture, and finally exporting or viewing.

Practice this question →
34
MCQhard

A network engineer runs the following command on Switch SW9: SW9# show monitor session 9 Session 9 --------- Type : Remote Destination Session Source RSPAN VLAN : 300 Destination Ports : Gi1/0/40 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?

A.This switch receives mirrored traffic from RSPAN VLAN 300 and sends it to Gi1/0/40.
B.This is a local SPAN session with source VLAN 300.
C.The RSPAN VLAN 300 is used to send traffic to a remote switch.
D.Ingress traffic on Gi1/0/40 is forwarded to the RSPAN VLAN.
AnswerA

The type 'Remote Destination Session' and source RSPAN VLAN confirm this.

Why this answer

This is an RSPAN destination session on SW9. The source is RSPAN VLAN 300, and the destination port Gi1/0/40 sends out the mirrored traffic. The destination port has Native encapsulation and ingress disabled, meaning it only forwards traffic from the RSPAN VLAN and does not forward incoming traffic.

Practice this question →
35
MCQhard

A network engineer needs to monitor traffic from a specific VLAN (VLAN 100) on a Cisco Catalyst 9300 switch and send the mirrored traffic to a monitoring station on a different switch across a routed network. The engineer decides to use ERSPAN. Which configuration is required on the source switch?

A.Configure 'monitor session 1 type erspan-source' and then 'source vlan 100' and 'destination ip 192.168.1.100'.
B.Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24'.
C.Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination remote vlan 999'.
D.Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24' and then 'monitor session 1 encapsulation replicate'.
AnswerA

Correct; ERSPAN source session requires the type erspan-source, source VLAN, and destination IP address.

Why this answer

ERSPAN encapsulates mirrored traffic in GRE and sends it over IP. On the source switch, the engineer must configure an ERSPAN source session that specifies the source VLAN and the destination IP address of the monitoring station or the destination switch. The correct answer is to configure 'monitor session 1 type erspan-source' and then specify the source VLAN and the destination IP.

Option B is incorrect because that is for local SPAN. Option C is incorrect because that is for RSPAN. Option D is incorrect because that is for local SPAN with a VLAN source.

Practice this question →
36
MCQmedium

Given the following configuration on a Cisco switch: monitor session 1 source interface GigabitEthernet1/0/1 - 3 both monitor session 1 destination interface GigabitEthernet1/0/4 What is the effect of this configuration?

A.Traffic from GigabitEthernet1/0/1, 1/0/2, and 1/0/3 is copied to GigabitEthernet1/0/4.
B.Only traffic from GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/4.
C.Traffic from GigabitEthernet1/0/4 is copied to GigabitEthernet1/0/1, 1/0/2, and 1/0/3.
D.The configuration is invalid because a SPAN session can only have one source interface.
AnswerA

The range syntax allows multiple source interfaces to be monitored to a single destination.

Why this answer

This configures a SPAN session that monitors multiple source interfaces (GigabitEthernet1/0/1 through 1/0/3) and sends their traffic to a single destination interface (GigabitEthernet1/0/4).

Practice this question →
37
MCQmedium

A network engineer runs the following command on Switch SW4: SW4# show monitor session 4 Session 4 --------- Type : Local Session Source VLANs : RX Only : 10,20 Destination Ports : Gi1/0/25 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?

A.Only incoming traffic on VLANs 10 and 20 is mirrored to Gi1/0/25.
B.Both incoming and outgoing traffic on VLANs 10 and 20 are mirrored.
C.This is an RSPAN session using VLANs 10 and 20 as remote VLANs.
D.The destination port Gi1/0/25 is configured to receive mirrored traffic.
AnswerA

Source VLANs are set to RX Only, so only received traffic is captured.

Why this answer

The session is local SPAN with source VLANs 10 and 20, capturing only received traffic (RX Only). The destination port Gi1/0/25 sends out the mirrored traffic with Native encapsulation and ingress disabled. This monitors incoming traffic on those VLANs.

Practice this question →
38
Matchingmedium

Drag and drop each ERSPAN version on the left to its correct header format on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

GRE header with 6-byte header containing session ID.

GRE header with 8-byte header containing session ID and timestamp.

4-byte field identifying the ERSPAN session.

4-byte field providing precise packet arrival time.

4-byte field used for packet ordering and deduplication.

Why these pairings

ERSPAN Type II (v1) uses a 6-byte GRE header with a 4-byte session ID; ERSPAN Type III (v2) uses an 8-byte GRE header with a 4-byte session ID and a 4-byte timestamp/index.

Practice this question →
39
Drag & Dropmedium

Drag and drop the steps of SPAN session on EtherChannel member ports into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

SPAN on EtherChannel requires configuring the session, specifying source ports (member or port-channel), setting destination, and enabling.

Practice this question →
40
Drag & Dropmedium

Drag and drop the steps of RSPAN VLAN propagation across trunk links into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The RSPAN VLAN must be created, allowed on trunks, and then used in sessions to propagate traffic across switches.

Practice this question →
41
MCQmedium

Consider the following SPAN configuration on a Cisco IOS-XE switch: monitor session 2 source interface GigabitEthernet1/0/3 rx monitor session 2 destination interface GigabitEthernet1/0/4 What is the effect of this configuration?

A.Only traffic received on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.
B.Both ingress and egress traffic on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.
C.Traffic on GigabitEthernet1/0/4 is mirrored to GigabitEthernet1/0/3.
D.The configuration is invalid because the destination interface must be in trunk mode.
AnswerA

The 'rx' keyword specifies ingress traffic only.

Why this answer

This SPAN session captures only ingress traffic (rx) from GigabitEthernet1/0/3 and sends it to GigabitEthernet1/0/4.

Practice this question →
42
Drag & Dropmedium

Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

ERSPAN configuration requires first defining the source and destination, then enabling the session. The order ensures the session references exist before activation.

Practice this question →
43
MCQmedium

A network engineer is troubleshooting a security issue and needs to capture all traffic between two servers connected to different switches. The switches are connected via a trunk link. The monitoring station is connected to a third switch. The engineer decides to use RSPAN. Which of the following is a mandatory requirement for RSPAN to function correctly?

A.The RSPAN VLAN must be configured as the native VLAN on all trunk ports.
B.The RSPAN VLAN must be pruned from all trunk ports to prevent loops.
C.The RSPAN VLAN must be configured with the 'remote-span' command on all switches.
D.The RSPAN VLAN must be the same as the management VLAN for the switches.
AnswerC

Correct; the 'remote-span' command designates the VLAN as an RSPAN VLAN, which prevents normal data traffic from using it and allows mirrored traffic.

Why this answer

RSPAN requires a dedicated VLAN (RSPAN VLAN) that is used to transport the mirrored traffic from source switches to the destination switch. This VLAN must be configured with the 'remote-span' command on all switches that participate. The correct answer is that the RSPAN VLAN must be configured with the 'remote-span' command.

Option A is incorrect because the RSPAN VLAN does not need to be the native VLAN. Option B is incorrect because the RSPAN VLAN does not need to be pruned; in fact, it must be allowed on all trunks. Option D is incorrect because the RSPAN VLAN must be consistent across all switches, but it is not required to be the management VLAN.

Practice this question →
44
MCQhard

An engineer is configuring RSPAN to monitor traffic from multiple switches in a data center. The monitoring station is connected to a central switch. The engineer has configured an RSPAN VLAN (VLAN 999) on all switches and set up the source sessions on the remote switches. However, the monitoring station receives no traffic. On the central switch, the engineer verifies that the RSPAN VLAN is active and that the destination session is configured. What is a likely missing configuration?

A.The trunk ports between the switches do not have the RSPAN VLAN (999) in their allowed VLAN list.
B.The destination session on the central switch is configured with 'monitor session 2 destination remote vlan 999' instead of 'monitor session 2 destination interface Gi1/0/1'.
C.The source sessions on the remote switches are configured with 'monitor session 1 source vlan 100' but the destination is not set to 'remote vlan 999'.
D.The RSPAN VLAN is not created as a remote SPAN VLAN; it must be configured with 'remote-span' command.
AnswerA

Correct; the RSPAN VLAN must be allowed on all trunk links to transport the mirrored traffic to the destination switch.

Why this answer

For RSPAN to work, the RSPAN VLAN must be allowed on all trunk links between the source switches and the destination switch. If the trunk ports do not have the RSPAN VLAN in their allowed list, the traffic will be dropped. Also, the RSPAN VLAN must not be pruned by VTP.

The correct answer is that the trunk ports between the switches are not configured to allow the RSPAN VLAN. Option B is incorrect because the destination session is already configured. Option C is incorrect because the source session is already configured.

Option D is incorrect because the RSPAN VLAN is active.

Practice this question →
45
Multi-Selecthard

Which three statements about RSPAN are true? (Choose three.)

Select 3 answers
A.The RSPAN VLAN must be allowed on all trunk links between the source and destination switches.
B.The RSPAN VLAN can be used for normal data traffic if needed.
C.On the destination switch, the RSPAN destination port is placed into the RSPAN VLAN.
D.RSPAN supports egress mirroring on the source switch.
E.The RSPAN VLAN must be configured on all switches in the path between source and destination.
AnswersA, C, E

Correct because the RSPAN VLAN carries mirrored traffic across the network and must be permitted on all intermediate trunks.

Why this answer

RSPAN uses a dedicated VLAN that must be allowed on trunk links between switches. The RSPAN VLAN should not be used for any other traffic. The destination port on the remote switch is placed in the RSPAN VLAN.

RSPAN does not support egress mirroring on the source switch (only ingress). The RSPAN VLAN does not participate in STP normally, but it can be configured to do so.

Practice this question →
46
Matchingmedium

Drag and drop each SPAN type on the left to its correct scope description on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Mirrors traffic on the same switch where the source and destination ports reside.

Mirrors traffic to a destination on a different switch using a dedicated VLAN.

Mirrors traffic to a destination reachable via Layer 3 using GRE encapsulation.

Receives the mirrored traffic and should be configured as a monitor session port.

The port whose traffic is being copied for monitoring.

Why these pairings

Local SPAN mirrors traffic on the same switch; RSPAN extends mirroring across switches using a dedicated VLAN; ERSPAN encapsulates mirrored packets in GRE for routing over Layer 3 networks.

Practice this question →
47
Matchingmedium

Drag and drop each traffic direction on the left to the correct SPAN keyword used to monitor it on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Monitors only traffic received on the source port.

Monitors only traffic transmitted from the source port.

Monitors both received and transmitted traffic on the source port.

Synonym for rx, monitors only incoming traffic.

Synonym for tx, monitors only outgoing traffic.

Why these pairings

The 'rx' keyword monitors only received traffic; 'tx' monitors only transmitted traffic; 'both' monitors both directions; 'ingress' and 'egress' are alternative keywords for the same concepts.

Practice this question →
48
Drag & Dropmedium

Drag and drop the steps of troubleshooting a failed RSPAN session into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order starts with verifying the RSPAN VLAN exists and is active on all switches, then checking that trunk links carry the RSPAN VLAN, then confirming the source SPAN session is correctly configured, then inspecting the destination SPAN session, and finally using debug or monitor commands to isolate the issue.

Practice this question →
49
Drag & Dropmedium

Drag and drop the steps of RSPAN session configuration and traffic flow into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order starts with creating a dedicated VLAN for RSPAN traffic, then configuring the source switch to monitor traffic and forward it to that VLAN, followed by configuring the intermediate switches to transport the RSPAN VLAN, then configuring the destination switch to receive and analyze the traffic, and finally verifying end-to-end packet flow.

Practice this question →
50
MCQhard

A network engineer runs the following command on Switch SW3: SW3# show monitor session 3 Session 3 --------- Type : Remote Destination Session Source RSPAN VLAN : 100 Destination Ports : Gi1/0/15 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?

A.This switch receives mirrored traffic from the RSPAN VLAN and sends it to Gi1/0/15.
B.This is a local SPAN session with source VLAN 100.
C.The RSPAN VLAN 100 is used to send traffic to a remote switch.
D.Ingress traffic on Gi1/0/15 is forwarded to the RSPAN VLAN.
AnswerA

The type 'Remote Destination Session' and source RSPAN VLAN indicate this.

Why this answer

The session type is Remote Destination Session, which is the destination switch in an RSPAN setup. The source is an RSPAN VLAN (100), and the destination port Gi1/0/15 is used to monitor traffic from that VLAN. The destination port has Native encapsulation and ingress disabled, meaning it only sends out the mirrored traffic from the RSPAN VLAN.

Practice this question →
51
Drag & Dropmedium

Drag and drop the steps of Multiple SPAN source ports with filter VLAN into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The configuration must first specify the session, then define sources and filter VLAN, and finally activate the session.

Practice this question →
52
Multi-Selectmedium

Which three statements about RSPAN configuration and behavior are true? (Choose three.)

Select 3 answers
A.The RSPAN VLAN must be created on all switches that participate in the RSPAN session.
B.The RSPAN destination port must be configured in access mode and assigned to the RSPAN VLAN.
C.Trunk ports between switches must allow the RSPAN VLAN and should not prune it.
D.The RSPAN source switch encapsulates the mirrored frames with the RSPAN VLAN ID.
E.RSPAN can only monitor source ports on the same switch as the destination port.
AnswersA, C, D

Correct because every switch in the path needs the RSPAN VLAN to forward the mirrored traffic.

Why this answer

RSPAN requires a dedicated VLAN that is not used for user traffic. The RSPAN VLAN must be created on all switches in the path, and the destination switch must have a destination port configured. The RSPAN VLAN should not be pruned from trunks.

The source switch sends mirrored frames into the RSPAN VLAN, and the destination switch extracts them.

Practice this question →
53
Multi-Selecthard

Which two statements about configuring SPAN on Cisco IOS-XE switches are true? (Choose two.)

Select 2 answers
A.A SPAN source can be a physical port or an EtherChannel interface.
B.A SPAN destination port can also be configured as a SPAN source port.
C.Only one source port can be configured per SPAN session.
D.The SPAN destination port must belong to the same VLAN as the source port.
E.A SPAN destination port cannot be a routed port.
AnswersA, E

Correct because SPAN supports both physical ports and port-channel interfaces as sources.

Why this answer

A SPAN source can be a single port or an EtherChannel. A SPAN destination port cannot be a source port simultaneously. The destination port must be in the same VLAN as the source for local SPAN? Actually, the destination port can be in any VLAN, but it is placed in a special SPAN mode.

The correct statements: source can be an EtherChannel; destination port cannot be a source port. The others are false: you can have multiple source ports; the destination port does not need to be in the same VLAN; you cannot use a routed port as a SPAN destination.

Practice this question →
54
Drag & Dropmedium

Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

ERSPAN configuration requires first defining the source, then the destination with encapsulation, optionally filtering VLANs, and finally activating the session.

Practice this question →
55
Matchingmedium

Drag and drop each SPAN type on the left to its correct scope description on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Mirrors traffic only on the source switch

Uses a dedicated VLAN to carry mirrored traffic between switches

Encapsulates mirrored traffic in GRE and routes over IP

Receives a copy of monitored traffic

The interface being monitored

Why these pairings

Local SPAN mirrors traffic on the same switch; RSPAN uses a dedicated VLAN to transport mirrored traffic across switches; ERSPAN encapsulates mirrored packets in GRE and routes them over Layer 3.

Practice this question →
56
Matchingmedium

Drag and drop each RSPAN VLAN requirement on the left to its correct restriction on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Must not be the native VLAN on any trunk

Why these pairings

The RSPAN VLAN must not be the native VLAN; it must be allowed on all trunk ports between source and destination; no other traffic should use it; it must exist on all intermediate switches; it must be configured as an RSPAN VLAN.

Practice this question →
57
Multi-Selectmedium

Which three statements about SPAN and RSPAN limitations are true? (Choose three.)

Select 3 answers
A.SPAN can cause increased CPU utilization on the switch if many packets are mirrored.
B.SPAN can monitor control plane traffic such as routing protocol updates by default.
C.RSPAN requires that the RSPAN VLAN be pruned from all trunks to avoid loops.
D.A SPAN destination port cannot be used for normal network traffic.
E.RSPAN can be used to monitor traffic on a Layer 3 routed interface.
AnswersA, C, D

Correct because mirroring high-bandwidth traffic can stress the switch CPU.

Why this answer

SPAN and RSPAN can impact switch performance due to increased CPU/memory usage. SPAN cannot monitor control plane traffic (e.g., routing updates) unless specifically configured. RSPAN requires a dedicated VLAN that must be pruned appropriately.

A SPAN destination port stops normal switching. RSPAN does not support Layer 3 routed interfaces as sources directly.

Practice this question →
58
MCQeasy

An engineer is configuring SPAN on a Cisco Catalyst 9300 switch to monitor traffic from a port that is part of an EtherChannel (Port-channel 1). The monitoring station is on port Gi1/0/24. Which configuration should the engineer use to capture traffic from the EtherChannel?

A.Configure 'monitor session 1 source interface Port-channel 1 both' and 'monitor session 1 destination interface Gi1/0/24'.
B.Configure 'monitor session 1 source interface Gi1/0/1 both' (where Gi1/0/1 is a member of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.
C.Configure 'monitor session 1 source vlan 100' (the VLAN of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.
D.Configure an RSPAN VLAN and use 'monitor session 1 source interface Port-channel 1' and 'monitor session 1 destination remote vlan 999'.
AnswerA

Correct; SPAN can source from a port-channel interface, capturing all traffic on the EtherChannel.

Why this answer

SPAN can source from an EtherChannel interface. The correct answer is to use the port-channel interface as the source. Option B is incorrect because individual member ports cannot be used as SPAN sources if they are part of an EtherChannel; the SPAN session must reference the port-channel.

Option C is incorrect because VLAN-based SPAN would capture all traffic on that VLAN, not just the EtherChannel. Option D is incorrect because RSPAN is not needed.

Practice this question →

Ready to test yourself?

Try a timed practice session using only SPAN and RSPAN questions.

Start 20-question session