The answer is that the RSPAN VLAN must be configured with the 'remote-span' command on all switches. This is a mandatory requirement because RSPAN uses a dedicated VLAN to carry mirrored traffic from source switches across the network to the destination switch where the monitoring station is connected; without the 'remote-span' command, the switches would treat this VLAN as a standard data VLAN, potentially causing loops or forwarding normal user traffic through it. On the ENCOR 350-401 exam, this concept tests your understanding of how to isolate monitoring traffic from production data, and a common trap is confusing the RSPAN VLAN with the native VLAN or assuming it must be pruned—in reality, the RSPAN VLAN must be allowed on all trunk links but never used for user data. A reliable memory tip is to think of "remote-span" as the "security seal" that tells every switch to treat that VLAN as a read-only mirror highway, not a regular road for traffic.
CCNP SPAN and RSPAN Practice Question
This 350-401 practice question tests your understanding of span and rspan. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network engineer is troubleshooting a security issue and needs to capture all traffic between two servers connected to different switches. The switches are connected via a trunk link. The monitoring station is connected to a third switch. The engineer decides to use RSPAN. Which of the following is a mandatory requirement for RSPAN to function correctly?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RSPAN VLAN must be configured with the 'remote-span' command on all switches.
RSPAN requires a dedicated VLAN (RSPAN VLAN) that is used to transport the mirrored traffic from source switches to the destination switch. This VLAN must be configured with the 'remote-span' command on all switches that participate. The correct answer is that the RSPAN VLAN must be configured with the 'remote-span' command. Option A is incorrect because the RSPAN VLAN does not need to be the native VLAN. Option B is incorrect because the RSPAN VLAN does not need to be pruned; in fact, it must be allowed on all trunks. Option D is incorrect because the RSPAN VLAN must be consistent across all switches, but it is not required to be the management VLAN.
Key principle: A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The RSPAN VLAN must be configured as the native VLAN on all trunk ports.
Why it's wrong here
Incorrect; the RSPAN VLAN does not need to be the native VLAN; it can be any VLAN.
✗
The RSPAN VLAN must be pruned from all trunk ports to prevent loops.
Why it's wrong here
Incorrect; the RSPAN VLAN must be allowed on trunk ports to transport traffic, not pruned.
✓
The RSPAN VLAN must be configured with the 'remote-span' command on all switches.
Why this is correct
Correct; the 'remote-span' command designates the VLAN as an RSPAN VLAN, which prevents normal data traffic from using it and allows mirrored traffic.
Related concept
Access ports place end devices into a single VLAN.
✗
The RSPAN VLAN must be the same as the management VLAN for the switches.
Why it's wrong here
Incorrect; the RSPAN VLAN is independent of the management VLAN.
Common exam traps
Common exam trap: an active trunk can still block the VLAN you need
A trunk being up does not prove every VLAN is crossing it. Check allowed VLAN lists, native VLAN mismatch, VLAN existence and access-port assignment.
Detailed technical explanation
How to think about this question
VLAN questions usually combine access-port and trunking clues. The key is to identify whether the issue is local to one switchport, caused by the trunk, or caused by the VLAN not existing where it needs to exist.
KKey Concepts to Remember
Access ports place end devices into a single VLAN.
Trunk ports carry multiple VLANs between switches.
Allowed VLAN lists decide which VLANs can cross a trunk.
Native VLAN mismatch can create confusing symptoms.
TExam Day Tips
→Use show vlan brief to verify access VLANs.
→Use show interfaces trunk to verify trunk state and allowed VLANs.
→Do not treat every same-VLAN issue as a routing problem.
Key takeaway
A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Got this wrong? Here's your next step.
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related 350-401 questions on switching, trunking, and access-port configuration.
SPAN and RSPAN — This question tests SPAN and RSPAN — Access ports place end devices into a single VLAN..
What is the correct answer to this question?
The correct answer is: The RSPAN VLAN must be configured with the 'remote-span' command on all switches. — RSPAN requires a dedicated VLAN (RSPAN VLAN) that is used to transport the mirrored traffic from source switches to the destination switch. This VLAN must be configured with the 'remote-span' command on all switches that participate. The correct answer is that the RSPAN VLAN must be configured with the 'remote-span' command. Option A is incorrect because the RSPAN VLAN does not need to be the native VLAN. Option B is incorrect because the RSPAN VLAN does not need to be pruned; in fact, it must be allowed on all trunks. Option D is incorrect because the RSPAN VLAN must be consistent across all switches, but it is not required to be the management VLAN.
What should I do if I get this 350-401 question wrong?
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related 350-401 questions on switching, trunking, and access-port configuration.
What is the key concept behind this question?
Access ports place end devices into a single VLAN.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Examine the following RSPAN configuration on a Cisco Catalyst switch:
vlan 100
name RSPAN_VLAN
remote-span
monitor session 1 source vlan 10 both
monitor session 1 destination remote vlan 100
Which statement about this configuration is true?
medium
✓ A.The RSPAN VLAN 100 must be created on all switches in the network that participate in RSPAN.
B.The destination remote vlan 100 command is incorrect; it should be 'destination remote vlan 100 encapsulation replicate'.
C.This configuration copies traffic from VLAN 10 to the local switch only.
D.The RSPAN VLAN 100 must be tagged on all trunk ports between switches.
Why A: This configures an RSPAN session where traffic from VLAN 10 is sent to the RSPAN VLAN 100, which is then transported across the network to other switches.
Variation 2. Examine the following RSPAN configuration on a Cisco switch:
vlan 200
name RSPAN_VLAN
remote-span
monitor session 3 source interface GigabitEthernet1/0/5 both
monitor session 3 destination remote vlan 200
interface GigabitEthernet1/0/10
switchport mode trunk
switchport trunk allowed vlan 200
What is missing for RSPAN to function correctly across multiple switches?
medium
✓ A.The RSPAN VLAN 200 must be created on all switches that will forward the mirrored traffic.
B.The destination remote vlan 200 command should include 'encapsulation replicate'.
C.The source interface must be in trunk mode to monitor VLANs.
D.The monitor session number must match on all switches.
Why A: For RSPAN to work across multiple switches, the RSPAN VLAN must be created on all switches and allowed on trunk links. The configuration shown only creates the VLAN on one switch and allows it on one trunk, but the VLAN must exist on all switches in the path.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.