hardMultiple Choice
CCNP Practice Question: Runs the following command on Switch SW9: SW9#…
A network engineer runs the following command on Switch SW9:
SW9# show monitor session 9
Session 9 --------- Type : Remote Destination Session Source RSPAN VLAN : 300 Destination Ports : Gi1/0/40
Encapsulation : Native
Ingress : Disabled
Based on this output, what can be concluded?
⚠ Common exam trap
Cisco often tests the distinction between source and destination RSPAN roles; the trap here is that candidates confuse 'Source RSPAN VLAN' as the source of traffic being mirrored, when in a destination session it actually refers to the VLAN that receives mirrored traffic from a remote source.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
This switch receives mirrored traffic from RSPAN VLAN 300 and sends it to Gi1/0/40.
The output shows a Remote Destination Session, meaning this switch (SW9) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 300 and forwards it out of the destination port Gi1/0/40. The 'Source RSPAN VLAN: 300' indicates the VLAN carrying the mirrored traffic from the remote source switch, and 'Destination Ports: Gi1/0/40' confirms the local egress port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
This switch receives mirrored traffic from RSPAN VLAN 300 and sends it to Gi1/0/40.
Why this is correct
The session type is Remote Destination Session, so this switch is the destination device: it receives mirrored traffic carried in source RSPAN VLAN 300 and forwards it out of destination port Gi1/0/40. Ingress is disabled, so traffic entering Gi1/0/40 is not mirrored.
- ✗
This is a local SPAN session with source VLAN 300.
Why it's wrong here
The output names a Remote Destination Session with a Source RSPAN VLAN, so the source is a VLAN carried across the network, not a local port or VLAN on SW9. Local SPAN would show Type: Local Session with local source ports or VLANs.
- ✗
The RSPAN VLAN 300 is used to send traffic to a remote switch.
Why it's wrong here
The RSPAN VLAN 300 is used to carry mirrored traffic from the source switch to the destination switch, but in this Remote Destination Session the destination port Gi1/0/40 is local to SW9, not on a remote switch. This option is tempting because RSPAN VLANs do transport mirrored traffic across switches to a remote monitoring device, but here the session type is "Remote Destination Session" with a local destination port, meaning the RSPAN VLAN terminates locally rather than forwarding to another switch.
- ✗
Ingress traffic on Gi1/0/40 is forwarded to the RSPAN VLAN.
Why it's wrong here
Ingress is Disabled on Gi1/0/40, so traffic arriving there is not copied into RSPAN VLAN 300; only egress traffic is monitored. The option tempts engineers who assume destination ports always capture bidirectional traffic, which applies when Ingress is explicitly enabled.
Visual reference
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.