CCNP Which statement about RSPAN is true? Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  RSPAN uses a dedicated VLAN to transport mirrored traffic from source to destination switches.

  Why this is correct

  RSPAN (Remote Switched Port Analyzer) is designed to forward mirrored traffic from a source switch across a network to a destination switch where an analyzer is attached. To achieve this, it defines a dedicated RSPAN VLAN that serves as a transport backbone: the source SPAN session copies frames into the RSPAN VLAN, and the destination SPAN session extracts those frames to a local monitor port. This VLAN must be allowed on all trunk links between the source and destination switches and should be used exclusively for mirrored traffic to prevent interference with production data.

• ✗

  RSPAN can only monitor traffic within the same switch.

  Why it's wrong here

  This statement incorrectly describes local SPAN, not RSPAN. A local SPAN session copies traffic only on the same switch and sends it to a local destination port, whereas RSPAN's entire purpose is to enable remote monitoring by carrying mirrored traffic over a Layer 2 switched network. With RSPAN, the source and destination switches are different devices, connected via trunk links that transport the dedicated RSPAN VLAN. Thus, limiting RSPAN to a single switch contradicts its fundamental architecture.

• ✗

  RSPAN requires the use of ERSPAN encapsulation.

  Why it's wrong here

  This is a false association. RSPAN operates at Layer 2 and relies on a standard VLAN to transport mirrored Ethernet frames between switches, with no IP or GRE encapsulation involved. ERSPAN (Encapsulated Remote Switched Port Analyzer) is a distinct technology that encapsulates mirrored packets in GRE and routes them over IP networks, often across Layer 3 boundaries. RSPAN and ERSPAN are separate solutions; choosing RSPAN does not require or imply ERSPAN encapsulation.

• ✗

  RSPAN destination ports must be in trunk mode.

  Why it's wrong here

  This is incorrect because RSPAN destination ports are normally configured as access ports placed in the RSPAN VLAN, not trunk ports. The trunk mode requirement applies to the inter-switch links that carry the RSPAN VLAN from the source switch to the destination switch. The final destination port, where the monitoring device is connected, must be an access port in the RSPAN VLAN so that only the extracted mirrored frames are delivered to the analyzer. Configuring a trunk on the destination port would introduce extra VLAN tagging and could confuse the monitoring tool.