Quick Answer

The correct order for local SPAN configuration steps on Cisco IOS begins with removing any existing SPAN session, then specifying the source interfaces or VLANs to monitor, defining the destination interface for the analyzer, optionally enabling encapsulation replication for trunk ports, and finally verifying the session is active. This sequence is critical because SPAN sessions are mutually exclusive on a switch; failing to clear a prior session with `no monitor session 1` will cause the new configuration to be rejected or overwrite the old one incorrectly. On the ENCOR 350-401 exam, this drag-and-drop task tests your ability to recall the exact CLI workflow, often with a trap that places the verification step too early or omits the removal step entirely. A common memory tip is the acronym **R-S-D-E-V**: Remove, Source, Destination, Encapsulation (optional), Verify—think of it as “Remove the old, Source what you watch, Destination where it goes, Encapsulate if trunked, then Verify the catch.”