CCNP Practice Question: Is monitoring traffic from a server connected to…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The destination port is automatically configured as a SPAN destination port, which disables normal switching on that port.

  Why this is correct

  In a SPAN configuration, the switch automatically reconfigures the designated destination port as a SPAN destination port. This places the port into a specialized monitoring mode where it no longer participates in the normal Layer 2 forwarding process, meaning it will not forward unicast or broadcast frames destined for end stations. Consequently, any device connected to that port will lose normal network connectivity and only receive the copied traffic from the SPAN session. This automatic behavior is a core characteristic of Cisco switches and is the direct cause of the observed symptom.

• ✗

  The destination port must be configured as a trunk port to forward SPAN traffic.

  Why it's wrong here

  The claim that the destination port must be a trunk is incorrect because the SPAN destination port's role is independent of its VLAN encapsulation type. Even if the port were configured as a trunk, it would still be placed into the SPAN monitoring state, which disables normal switching for all VLANs, including tagged traffic. The purpose of using a trunk in SPAN is only to preserve VLAN tags on the mirrored frames for analysis, not to enable or facilitate normal forwarding. Therefore, the lack of normal connectivity is not due to the absence of trunk configuration.

• ✗

  The destination port must be configured as an access port to forward SPAN traffic.

  Why it's wrong here

  Similarly, configuring the destination port as an access port does not restore or enable normal forwarding. The SPAN destination configuration overrides the port's access or trunk settings, and the switch disables all normal switching on that port regardless of its mode. Whether the port is an access port or a trunk, the result is identical: it becomes a dedicated monitor port and will not forward traffic for connected hosts. Thus, the issue is not that the port is an access port; it is that the port is now a SPAN destination.

• ✗

  The destination port is in an err-disabled state due to a loop.

  Why it's wrong here

  The err-disabled state is a switch security/protection feature triggered by events like loop detection, UDLD failures, or port-security violations, not by SPAN configuration. When a port is err-disabled, it is typically shut down and shows 'err-disabled' in the show interfaces output, and the switch logs the cause. In this scenario, the port is likely up and receiving mirrored packets, but the user perceives it as non-functional because normal traffic is not being forwarded. SPAN does not cause err-disabled; it places the port in a special monitor mode, which is a completely different operational state.