mediumMultiple ChoiceObjective-mapped
SPAN Direction: rx, tx, both
Given the following configuration snippet on a Cisco IOS-XE switch:
interface GigabitEthernet1/0/1 switchport mode access switchport access vlan 10 spanning-tree portfast
monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination interface GigabitEthernet1/0/2
What is the effect of this configuration?
Quick Answer
The correct answer is that all traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2. This is because the monitor session configuration explicitly specifies the `both` keyword for the source interface, which directs the SPAN session to replicate both ingress (rx) and egress (tx) traffic. Without the `both` keyword, the default behavior on Cisco IOS-XE switches is to copy only rx traffic, so specifying `both` ensures full-duplex traffic capture. On the ENCOR 350-401 exam, this tests your understanding of SPAN direction options—rx, tx, and both—and how they affect traffic monitoring. A common trap is assuming that omitting the direction keyword defaults to `both`, but it actually defaults to `rx` only. Remember the mnemonic: "Both is best for full capture, rx is the default rapture."
⚠ Common exam trap
Candidates often confuse 'both' with 'rx' or 'tx' and assume only one direction is mirrored, or they mistakenly think the destination port must be in trunk mode to carry VLAN tags, but in local SPAN the destination port can be an access port and the mirrored frames are sent untagged by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
All traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.
The configuration uses a local SPAN session to copy traffic from a source interface (GigabitEthernet1/0/1) to a destination interface (GigabitEthernet1/0/2). The keyword 'both' specifies that both ingress and egress traffic on the source port are mirrored, so all traffic entering and leaving GigabitEthernet1/0/1 is sent to the destination port for monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
All traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.
Why this is correct
The 'both' keyword copies both ingress and egress traffic from the source interface to the destination.
- ✗
Only traffic entering GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.
Why it's wrong here
The 'both' keyword copies both directions, not just ingress.
- ✗
Traffic on GigabitEthernet1/0/2 is replicated to GigabitEthernet1/0/1.
Why it's wrong here
The monitor session defines source and destination; traffic flows from source to destination, not the reverse.
- ✗
The configuration is invalid because the destination port must be in trunk mode.
Why it's wrong here
A SPAN destination port can be an access port; trunk mode is not required.
Visual reference
About these practice questions
This 350-401 question is part of Courseiva's 1,175-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Consider the following SPAN configuration on a Cisco IOS-XE switch: monitor session 2 source interface GigabitEthernet1/0/3 rx monitor session 2 destination interface GigabitEthernet1/0/4 What is the effect of this configuration?
medium- ✓ A.Only traffic received on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.
- B.Both ingress and egress traffic on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.
- C.Traffic on GigabitEthernet1/0/4 is mirrored to GigabitEthernet1/0/3.
- D.The configuration is invalid because the destination interface must be in trunk mode.
Why A: The configuration explicitly specifies the `rx` keyword for the source interface, which limits SPAN to copying only received (ingress) traffic on GigabitEthernet1/0/3 to the destination interface GigabitEthernet1/0/4. Without the `rx` or `tx` keyword, the default behavior would copy both directions, but here the explicit `rx` overrides that default.
Variation 2. Given the following SPAN configuration on a Cisco IOS-XE switch: monitor session 4 source interface GigabitEthernet1/0/6 tx monitor session 4 destination interface GigabitEthernet1/0/7 What does this configuration do?
medium- ✓ A.Only traffic transmitted from GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.
- B.Both ingress and egress traffic on GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.
- C.Traffic on GigabitEthernet1/0/7 is mirrored to GigabitEthernet1/0/6.
- D.The configuration is invalid because the destination interface must be in the same VLAN as the source.
Why A: The configuration uses the 'tx' keyword to specify that only traffic transmitted (egress) from GigabitEthernet1/0/6 should be copied to the destination interface GigabitEthernet1/0/7. Without the 'tx' keyword, the default behavior would be to monitor both ingress and egress traffic, but the explicit 'tx' limits the SPAN session to egress traffic only.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.