mediumMultiple Select
CCNP SPAN destination port Practice Question
Which two statements about SPAN and RSPAN limitations are true? (Choose two.)
⚠ Common exam trap
350-401 often tests the misconception that SPAN can monitor control plane traffic by default or that RSPAN VLANs should be pruned, when in fact they must be allowed on trunks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SPAN can cause increased CPU utilization on the switch if many packets are mirrored.
Option A is correct because SPAN mirrors copies of every matched frame to the destination port, and when large volumes of traffic are mirrored, the switch must replicate and forward those frames, which increases CPU and internal forwarding load. Option D is correct because a SPAN destination port is dedicated to receiving mirrored traffic; by design it does not participate in normal Layer 2 forwarding, so it cannot be used as a regular user or uplink port while configured as a destination. Option B is not correct because SPAN does not monitor control plane traffic such as routing protocol updates by default; control plane traffic is handled by the switch CPU and requires specific features like CPU port mirroring or control plane policing to observe. Option C is not correct because RSPAN VLANs should be allowed on the trunks carrying the monitored traffic, not pruned everywhere; pruning the RSPAN VLAN from all trunks would prevent the mirrored traffic from reaching the destination. Option E is not correct because RSPAN monitors traffic at Layer 2 and is not used to monitor traffic on a Layer 3 routed interface directly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SPAN can cause increased CPU utilization on the switch if many packets are mirrored.
Why this is correct
Mirroring copies every matching frame to the destination port, so the supervisor and forwarding ASIC must process duplicate traffic. This extra per-packet work consumes switch CPU and backplane bandwidth, which is the SPAN limitation the stem asks about.
- ✗
SPAN can monitor control plane traffic such as routing protocol updates by default.
Why it's wrong here
SPAN replicates only data-plane frames arriving at the source port; control-plane traffic such as routing protocol updates is not captured by default, so this statement is false. It tempts candidates who assume all traffic is mirrored. Capturing control-plane traffic requires a different mechanism, such as a CPU-bound or inband copy.
- ✗
RSPAN requires that the RSPAN VLAN be pruned from all trunks to avoid loops.
Why it's wrong here
The RSPAN VLAN must be allowed on all trunk links carrying monitored traffic, not pruned; pruning it would break the remote monitoring path. This statement inverts the actual requirement. Pruning is used to limit normal VLAN flooding, which is a separate design concern from RSPAN transport.
- ✓
A SPAN destination port cannot be used for normal network traffic.
Why this is correct
A SPAN destination port is dedicated solely to receiving mirrored traffic, so it cannot forward normal user or network traffic. This limitation distinguishes SPAN destination ports from regular switch ports and prevents loops or forwarding conflicts.
- ✗
RSPAN can be used to monitor traffic on a Layer 3 routed interface.
Why it's wrong here
RSPAN sources are switch ports or VLANs, not Layer 3 routed interfaces; SPAN likewise monitors switched ports rather than routed interfaces. The statement is false. Monitoring a routed interface requires a different capture method, such as a router-based embedded packet capture or NetFlow-style export.
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.