SPAN and RSPAN practice questions

A network engineer is troubleshooting a performance issue between two hosts connected to a Cisco Catalyst 3850 switch. The engineer wants to capture all traffic sent and received by Host A (Gi1/0/1) and send it to a monitoring station connected to Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. However, the monitoring station receives only traffic sent by Host A, not traffic received. What is the most likely cause?

Trap 1: The source interface is configured as an access port, and the SPAN…

Incorrect; SPAN can capture both directions on an access port.

Trap 2: The 'monitor session 1 destination interface Gi1/0/24' command does…

Incorrect; the destination interface command supports both directions; the issue is not about direction support.

Trap 3: The engineer must also configure 'monitor session 1 filter ip' to…

Incorrect; filter is optional and not required for basic capture.

A
The source interface is configured as an access port, and the SPAN session cannot capture both directions on an access port.
Why wrong: Incorrect; SPAN can capture both directions on an access port.
B
The destination port is in the same VLAN as the source interface, causing the switch to drop the copied frames due to loop prevention.
Correct; when the destination port is in the same VLAN as the source, the switch may drop the replicated frames to prevent loops, especially if the destination port is also in the forwarding path.
C
The 'monitor session 1 destination interface Gi1/0/24' command does not support egress SPAN; only ingress SPAN is allowed.
Why wrong: Incorrect; the destination interface command supports both directions; the issue is not about direction support.
D
The engineer must also configure 'monitor session 1 filter ip' to capture both directions.
Why wrong: Incorrect; filter is optional and not required for basic capture.

Question 2hardmultiple choice

A network engineer needs to monitor traffic between two VLANs on a Cisco Catalyst 9300 switch. The engineer wants to capture all packets that traverse the switch between VLAN 10 and VLAN 20. The monitoring station is connected to port Gi1/0/24. Which configuration should the engineer use to capture this inter-VLAN traffic?

Trap 1: Configure 'monitor session 1 source interface Gi1/0/1 both' and…

Incorrect; this would only capture traffic on that specific interface, not all inter-VLAN traffic.

Trap 2: Configure an RSPAN VLAN and use 'monitor session 1 source vlan 10 -…

Incorrect; RSPAN is used when the monitoring station is on a different switch; here it is local.

Trap 3: Configure an ERSPAN session with source IP and destination IP.

Incorrect; ERSPAN is for encapsulating traffic over IP, not necessary for local capture.

A
Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.
Why wrong: Incorrect; this would only capture traffic on that specific interface, not all inter-VLAN traffic.
B
Configure 'monitor session 1 source vlan 10 - 20 both' and 'monitor session 1 destination interface Gi1/0/24'.
Correct; VLAN-based SPAN captures all traffic entering or leaving the specified VLANs, including routed traffic between them.
C
Configure an RSPAN VLAN and use 'monitor session 1 source vlan 10 - 20' and 'monitor session 1 destination remote vlan 100'.
Why wrong: Incorrect; RSPAN is used when the monitoring station is on a different switch; here it is local.
D
Configure an ERSPAN session with source IP and destination IP.
Why wrong: Incorrect; ERSPAN is for encapsulating traffic over IP, not necessary for local capture.

Question 3hardmultiple choice

An engineer is configuring RSPAN to monitor traffic from multiple switches in a data center. The monitoring station is connected to a central switch. The engineer has configured an RSPAN VLAN (VLAN 999) on all switches and set up the source sessions on the remote switches. However, the monitoring station receives no traffic. On the central switch, the engineer verifies that the RSPAN VLAN is active and that the destination session is configured. What is a likely missing configuration?

Trap 1: The destination session on the central switch is configured with…

Incorrect; the destination session should use 'destination remote vlan' to receive from the RSPAN VLAN, but the question says the destination session is configured, so this is not the missing piece.

Trap 2: The source sessions on the remote switches are configured with…

Incorrect; the source session should have 'destination remote vlan 999', but the question states the source sessions are configured, so this is not the missing piece.

Trap 3: The RSPAN VLAN is not created as a remote SPAN VLAN; it must be…

Incorrect; the 'remote-span' command is used on the VLAN to designate it as an RSPAN VLAN, but the question says the VLAN is active, implying it is configured. However, this is a common missing step, but the most likely missing configuration is the trunk allowance.

A
The trunk ports between the switches do not have the RSPAN VLAN (999) in their allowed VLAN list.
Correct; the RSPAN VLAN must be allowed on all trunk links to transport the mirrored traffic to the destination switch.
B
The destination session on the central switch is configured with 'monitor session 2 destination remote vlan 999' instead of 'monitor session 2 destination interface Gi1/0/1'.
Why wrong: Incorrect; the destination session should use 'destination remote vlan' to receive from the RSPAN VLAN, but the question says the destination session is configured, so this is not the missing piece.
C
The source sessions on the remote switches are configured with 'monitor session 1 source vlan 100' but the destination is not set to 'remote vlan 999'.
Why wrong: Incorrect; the source session should have 'destination remote vlan 999', but the question states the source sessions are configured, so this is not the missing piece.
D
The RSPAN VLAN is not created as a remote SPAN VLAN; it must be configured with 'remote-span' command.
Why wrong: Incorrect; the 'remote-span' command is used on the VLAN to designate it as an RSPAN VLAN, but the question says the VLAN is active, implying it is configured. However, this is a common missing step, but the most likely missing configuration is the trunk allowance.

Question 4mediummultiple choice

A network engineer is using a Cisco Catalyst 3850 switch to monitor traffic from a server connected to port Gi1/0/1. The monitoring station is on port Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. The monitoring station receives traffic, but the engineer notices that the switch CPU utilization is high. What is the most likely cause of the high CPU?

Trap 1: The SPAN session is capturing both directions, which doubles the…

Incorrect; capturing both directions is normal and should not cause excessive CPU if the traffic volume is not high.

Trap 2: The destination port is not configured with 'switchport…

Incorrect; DTP is not related to SPAN CPU usage.

Trap 3: The source interface is a trunk port, and SPAN is capturing all…

Incorrect; the scenario does not mention trunk, and even if it were, it would not necessarily cause high CPU unless the traffic volume is high.

A
The SPAN session is capturing both directions, which doubles the number of packets and increases CPU usage.
Why wrong: Incorrect; capturing both directions is normal and should not cause excessive CPU if the traffic volume is not high.
B
The destination port is not configured with 'switchport nonegotiate' and is still participating in DTP, causing CPU overhead.
Why wrong: Incorrect; DTP is not related to SPAN CPU usage.
C
The destination port is still a member of a VLAN, and the switch is processing the copied frames as normal traffic, leading to high CPU.
Correct; when a destination port is not dedicated to SPAN, the switch may attempt to switch the copied frames, increasing CPU load.
D
The source interface is a trunk port, and SPAN is capturing all VLANs, causing high CPU.
Why wrong: Incorrect; the scenario does not mention trunk, and even if it were, it would not necessarily cause high CPU unless the traffic volume is high.

Question 5hardmultiple choice

A network engineer needs to monitor traffic from a specific VLAN (VLAN 100) on a Cisco Catalyst 9300 switch and send the mirrored traffic to a monitoring station on a different switch across a routed network. The engineer decides to use ERSPAN. Which configuration is required on the source switch?

Trap 1: Configure 'monitor session 1 source vlan 100' and 'monitor session…

Incorrect; this is local SPAN, not ERSPAN.

Trap 2: Configure 'monitor session 1 source vlan 100' and 'monitor session…

Incorrect; this is RSPAN, which requires a Layer 2 path, not a routed network.

Trap 3: Configure 'monitor session 1 source vlan 100' and 'monitor session…

Incorrect; this is still local SPAN with encapsulation, not ERSPAN.

A
Configure 'monitor session 1 type erspan-source' and then 'source vlan 100' and 'destination ip 192.168.1.100'.
Correct; ERSPAN source session requires the type erspan-source, source VLAN, and destination IP address.
B
Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24'.
Why wrong: Incorrect; this is local SPAN, not ERSPAN.
C
Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination remote vlan 999'.
Why wrong: Incorrect; this is RSPAN, which requires a Layer 2 path, not a routed network.
D
Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24' and then 'monitor session 1 encapsulation replicate'.
Why wrong: Incorrect; this is still local SPAN with encapsulation, not ERSPAN.

Question 6mediummultiple choice

An engineer is configuring SPAN on a Cisco Catalyst 3850 switch to monitor traffic from a trunk port (Gi1/0/1) that carries VLANs 10, 20, and 30. The monitoring station is on port Gi1/0/24. The engineer wants to capture only VLAN 20 traffic from the trunk. Which configuration should the engineer use?

Trap 1: Configure 'monitor session 1 source interface Gi1/0/1 both' and…

Incorrect; this would capture all VLANs on the trunk, not just VLAN 20.

Trap 2: Configure 'monitor session 1 source vlan 20' and 'monitor session 1…

Incorrect; this would capture all traffic on VLAN 20 from all ports, not just the trunk port.

Trap 3: Configure 'monitor session 1 source interface Gi1/0/1 both' and…

Incorrect; this would filter out VLANs 10 and 30, but the filter is applied to the source, and the syntax is 'filter vlan' with the VLANs to include, not exclude.

A
Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 20'.
Correct; the filter vlan option limits the SPAN session to only VLAN 20 traffic on the source interface.
B
Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.
Why wrong: Incorrect; this would capture all VLANs on the trunk, not just VLAN 20.
C
Configure 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface Gi1/0/24'.
Why wrong: Incorrect; this would capture all traffic on VLAN 20 from all ports, not just the trunk port.
D
Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 10,30'.
Why wrong: Incorrect; this would filter out VLANs 10 and 30, but the filter is applied to the source, and the syntax is 'filter vlan' with the VLANs to include, not exclude.

Question 7mediummultiple choice

A network engineer is troubleshooting a security issue and needs to capture all traffic between two servers connected to different switches. The switches are connected via a trunk link. The monitoring station is connected to a third switch. The engineer decides to use RSPAN. Which of the following is a mandatory requirement for RSPAN to function correctly?

Trap 1: The RSPAN VLAN must be configured as the native VLAN on all trunk…

Incorrect; the RSPAN VLAN does not need to be the native VLAN; it can be any VLAN.

Trap 2: The RSPAN VLAN must be pruned from all trunk ports to prevent loops.

Incorrect; the RSPAN VLAN must be allowed on trunk ports to transport traffic, not pruned.

Trap 3: The RSPAN VLAN must be the same as the management VLAN for the…

Incorrect; the RSPAN VLAN is independent of the management VLAN.

A
The RSPAN VLAN must be configured as the native VLAN on all trunk ports.
Why wrong: Incorrect; the RSPAN VLAN does not need to be the native VLAN; it can be any VLAN.
B
The RSPAN VLAN must be pruned from all trunk ports to prevent loops.
Why wrong: Incorrect; the RSPAN VLAN must be allowed on trunk ports to transport traffic, not pruned.
C
The RSPAN VLAN must be configured with the 'remote-span' command on all switches.
Correct; the 'remote-span' command designates the VLAN as an RSPAN VLAN, which prevents normal data traffic from using it and allows mirrored traffic.
D
The RSPAN VLAN must be the same as the management VLAN for the switches.
Why wrong: Incorrect; the RSPAN VLAN is independent of the management VLAN.

Read the full EtherChannel explanation →

Question 8easymultiple choice

An engineer is configuring SPAN on a Cisco Catalyst 9300 switch to monitor traffic from a port that is part of an EtherChannel (Port-channel 1). The monitoring station is on port Gi1/0/24. Which configuration should the engineer use to capture traffic from the EtherChannel?

Trap 1: Configure 'monitor session 1 source interface Gi1/0/1 both' (where…

Incorrect; individual member ports cannot be used as SPAN sources if they are part of an EtherChannel; the port-channel must be used.

Trap 2: Configure 'monitor session 1 source vlan 100' (the VLAN of the…

Incorrect; this would capture all traffic on that VLAN, not just the EtherChannel.

Trap 3: Configure an RSPAN VLAN and use 'monitor session 1 source interface…

Incorrect; RSPAN is not needed for local monitoring.

A
Configure 'monitor session 1 source interface Port-channel 1 both' and 'monitor session 1 destination interface Gi1/0/24'.
Correct; SPAN can source from a port-channel interface, capturing all traffic on the EtherChannel.
B
Configure 'monitor session 1 source interface Gi1/0/1 both' (where Gi1/0/1 is a member of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.
Why wrong: Incorrect; individual member ports cannot be used as SPAN sources if they are part of an EtherChannel; the port-channel must be used.
C
Configure 'monitor session 1 source vlan 100' (the VLAN of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.
Why wrong: Incorrect; this would capture all traffic on that VLAN, not just the EtherChannel.
D
Configure an RSPAN VLAN and use 'monitor session 1 source interface Port-channel 1' and 'monitor session 1 destination remote vlan 999'.
Why wrong: Incorrect; RSPAN is not needed for local monitoring.

Question 9easymultiple choice

A network engineer is monitoring traffic from a server connected to a Cisco Catalyst 3850 switch. The engineer configures a SPAN session with source interface Gi1/0/1 and destination interface Gi1/0/24. The monitoring station receives traffic, but the engineer notices that the destination port is not forwarding any normal traffic. What is the most likely reason?

Trap 1: The destination port must be configured as a trunk port to forward…

Incorrect; the destination port can be an access or trunk port, but it will still not forward normal traffic.

Trap 2: The destination port must be configured as an access port to…

Incorrect; the port type does not affect the forwarding of normal traffic; it is the SPAN destination configuration that disables normal switching.

Trap 3: The destination port is in an err-disabled state due to a loop.

Incorrect; the scenario does not indicate any loop or error condition.

A
The destination port is automatically configured as a SPAN destination port, which disables normal switching on that port.
Correct; a SPAN destination port is dedicated to receiving mirrored traffic and does not forward normal traffic.
B
The destination port must be configured as a trunk port to forward SPAN traffic.
Why wrong: Incorrect; the destination port can be an access or trunk port, but it will still not forward normal traffic.
C
The destination port must be configured as an access port to forward SPAN traffic.
Why wrong: Incorrect; the port type does not affect the forwarding of normal traffic; it is the SPAN destination configuration that disables normal switching.
D
The destination port is in an err-disabled state due to a loop.
Why wrong: Incorrect; the scenario does not indicate any loop or error condition.

Question 10mediummultiple choice

A network engineer runs the following command on Switch SW1:

SW1# show monitor session 1

Session 1 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Both : Gi1/0/2 Destination Ports : Gi1/0/10

Encapsulation      : Native

Ingress : Disabled

Based on this output, what can be concluded?

Trap 1: This is an RSPAN session that sends traffic to a remote VLAN.

The type is Local, not Remote; RSPAN would show a remote VLAN.

Trap 2: Ingress traffic on Gi1/0/10 is forwarded to the source ports.

Ingress is disabled, so no forwarding occurs.

Trap 3: The destination port is configured to capture only egress traffic.

The source ports capture both ingress and egress traffic, not the destination.

A
Traffic from Gi1/0/1 and Gi1/0/2 is copied to Gi1/0/10 for monitoring.
The session type is Local, source ports are in both directions, and destination is Gi1/0/10.
B
This is an RSPAN session that sends traffic to a remote VLAN.
Why wrong: The type is Local, not Remote; RSPAN would show a remote VLAN.
C
Ingress traffic on Gi1/0/10 is forwarded to the source ports.
Why wrong: Ingress is disabled, so no forwarding occurs.
D
The destination port is configured to capture only egress traffic.
Why wrong: The source ports capture both ingress and egress traffic, not the destination.

Question 11mediummultiple choice

A network engineer runs the following command on Switch SW2:

SW2# show monitor session 2

Session 2 --------- Type : Remote Source Session Source Ports : TX Only : Gi1/0/5 RX Only : Gi1/0/6 Destination Ports : Gi1/0/20

Encapsulation      : Replicate

Based on this output, what can be concluded?

Trap 1: This is a local SPAN session with bidirectional capture.

The type is Remote Source, not Local, and capture is unidirectional per port.

Trap 2: The destination port Gi1/0/20 is used to receive mirrored traffic…

In a source session, the destination port sends traffic out, not receives.

Trap 3: Both source ports capture all traffic in both directions.

Gi1/0/5 captures TX only, Gi1/0/6 captures RX only.

A
This is an RSPAN source session, sending mirrored traffic to a remote VLAN.
The type 'Remote Source Session' and Replicate encapsulation indicate RSPAN.
B
This is a local SPAN session with bidirectional capture.
Why wrong: The type is Remote Source, not Local, and capture is unidirectional per port.
C
The destination port Gi1/0/20 is used to receive mirrored traffic from another switch.
Why wrong: In a source session, the destination port sends traffic out, not receives.
D
Both source ports capture all traffic in both directions.
Why wrong: Gi1/0/5 captures TX only, Gi1/0/6 captures RX only.

Question 12hardmultiple choice

A network engineer runs the following command on Switch SW3:

SW3# show monitor session 3

Session 3 --------- Type : Remote Destination Session Source RSPAN VLAN : 100 Destination Ports : Gi1/0/15

Encapsulation      : Native

Ingress : Disabled

Based on this output, what can be concluded?

Trap 1: This is a local SPAN session with source VLAN 100.

The type is Remote Destination, not Local.

Trap 2: The RSPAN VLAN 100 is used to send traffic to a remote switch.

This switch is the destination, so it receives from the RSPAN VLAN.

Trap 3: Ingress traffic on Gi1/0/15 is forwarded to the RSPAN VLAN.

Ingress is disabled, so no forwarding occurs.

A
This switch receives mirrored traffic from the RSPAN VLAN and sends it to Gi1/0/15.
The type 'Remote Destination Session' and source RSPAN VLAN indicate this.
B
This is a local SPAN session with source VLAN 100.
Why wrong: The type is Remote Destination, not Local.
C
The RSPAN VLAN 100 is used to send traffic to a remote switch.
Why wrong: This switch is the destination, so it receives from the RSPAN VLAN.
D
Ingress traffic on Gi1/0/15 is forwarded to the RSPAN VLAN.
Why wrong: Ingress is disabled, so no forwarding occurs.

Question 13mediummultiple choice

A network engineer runs the following command on Switch SW4:

SW4# show monitor session 4

Session 4 --------- Type : Local Session Source VLANs : RX Only : 10,20 Destination Ports : Gi1/0/25

Encapsulation      : Native

Ingress : Disabled

Based on this output, what can be concluded?

Trap 1: Both incoming and outgoing traffic on VLANs 10 and 20 are mirrored.

Only RX is specified, not Both.

Trap 2: This is an RSPAN session using VLANs 10 and 20 as remote VLANs.

The type is Local, not Remote.

Trap 3: The destination port Gi1/0/25 is configured to receive mirrored…

The destination port sends traffic out, not receives.

A
Only incoming traffic on VLANs 10 and 20 is mirrored to Gi1/0/25.
Source VLANs are set to RX Only, so only received traffic is captured.
B
Both incoming and outgoing traffic on VLANs 10 and 20 are mirrored.
Why wrong: Only RX is specified, not Both.
C
This is an RSPAN session using VLANs 10 and 20 as remote VLANs.
Why wrong: The type is Local, not Remote.
D
The destination port Gi1/0/25 is configured to receive mirrored traffic.
Why wrong: The destination port sends traffic out, not receives.

Question 14hardmultiple choice

A network engineer runs the following command on Switch SW5:

SW5# show monitor session 5

Session 5 --------- Type : Remote Source Session Source Ports : Both : Gi1/0/1-3 Destination Ports : Gi1/0/24

Encapsulation      : Replicate

Based on this output, what can be concluded?

Trap 1: This is a local SPAN session that sends traffic to Gi1/0/24.

The type is Remote Source, not Local.

Trap 2: The destination port Gi1/0/24 is used to receive mirrored traffic…

In a source session, the destination port sends traffic out.

Trap 3: Only egress traffic from Gi1/0/1-3 is captured.

Both directions are captured (Both keyword).

A
Traffic from ports Gi1/0/1-3 is mirrored and sent to a remote VLAN via Gi1/0/24.
The type 'Remote Source Session' and Replicate encapsulation indicate RSPAN source.
B
This is a local SPAN session that sends traffic to Gi1/0/24.
Why wrong: The type is Remote Source, not Local.
C
The destination port Gi1/0/24 is used to receive mirrored traffic from another switch.
Why wrong: In a source session, the destination port sends traffic out.
D
Only egress traffic from Gi1/0/1-3 is captured.
Why wrong: Both directions are captured (Both keyword).

Question 15mediummultiple choice

A network engineer runs the following command on Switch SW6:

SW6# show monitor session 6

Session 6 --------- Type : Remote Destination Session Source RSPAN VLAN : 200 Destination Ports : Gi1/0/12

Encapsulation      : Native

Ingress : Disabled

Based on this output, what can be concluded?

Trap 1: This is a local SPAN session with source VLAN 200.

The type is Remote Destination, not Local.

Trap 2: The RSPAN VLAN 200 is used to send traffic to a remote switch.

This switch is the destination, so it receives from the VLAN.

Trap 3: Ingress traffic on Gi1/0/12 is forwarded to the RSPAN VLAN.

Ingress is disabled.

A
This switch receives mirrored traffic from RSPAN VLAN 200 and sends it to Gi1/0/12.
The type 'Remote Destination Session' and source RSPAN VLAN confirm this.
B
This is a local SPAN session with source VLAN 200.
Why wrong: The type is Remote Destination, not Local.
C
The RSPAN VLAN 200 is used to send traffic to a remote switch.
Why wrong: This switch is the destination, so it receives from the VLAN.
D
Ingress traffic on Gi1/0/12 is forwarded to the RSPAN VLAN.
Why wrong: Ingress is disabled.

Question 16hardmultiple choice

A network engineer runs the following command on Switch SW7:

SW7# show monitor session 7

Session 7 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Destination Ports : Gi1/0/20

Encapsulation      : Native

Ingress : Enabled

Based on this output, what can be concluded?

Trap 1: This is an RSPAN session with a remote VLAN.

The type is Local, not Remote.

Trap 2: Only egress traffic from Gi1/0/1 is mirrored.

Both directions are captured.

Trap 3: The destination port is configured to block all incoming traffic.

Ingress is enabled, so traffic is not blocked.

A
The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.
Ingress enabled allows the port to forward received traffic.
B
This is an RSPAN session with a remote VLAN.
Why wrong: The type is Local, not Remote.
C
Only egress traffic from Gi1/0/1 is mirrored.
Why wrong: Both directions are captured.
D
The destination port is configured to block all incoming traffic.
Why wrong: Ingress is enabled, so traffic is not blocked.

Question 17mediummultiple choice

A network engineer runs the following command on Switch SW8:

SW8# show monitor session 8

Session 8 --------- Type : Remote Source Session Source VLANs : Both : 30 Destination Ports : Gi1/0/30

Encapsulation      : Replicate

Based on this output, what can be concluded?

Trap 1: This is a local SPAN session that monitors VLAN 30.

The type is Remote Source, not Local.

Trap 2: Only received traffic on VLAN 30 is captured.

Both directions are captured.

Trap 3: The destination port Gi1/0/30 is used to receive mirrored traffic.

In a source session, the destination port sends traffic out.

A
All traffic on VLAN 30 is mirrored and sent to a remote VLAN via Gi1/0/30.
The type 'Remote Source Session' and Replicate encapsulation indicate RSPAN.
B
This is a local SPAN session that monitors VLAN 30.
Why wrong: The type is Remote Source, not Local.
C
Only received traffic on VLAN 30 is captured.
Why wrong: Both directions are captured.
D
The destination port Gi1/0/30 is used to receive mirrored traffic.
Why wrong: In a source session, the destination port sends traffic out.

Question 18hardmultiple choice

A network engineer runs the following command on Switch SW9:

SW9# show monitor session 9

Session 9 --------- Type : Remote Destination Session Source RSPAN VLAN : 300 Destination Ports : Gi1/0/40

Encapsulation      : Native

Ingress : Disabled

Based on this output, what can be concluded?

Trap 1: This is a local SPAN session with source VLAN 300.

The type is Remote Destination, not Local.

Trap 2: The RSPAN VLAN 300 is used to send traffic to a remote switch.

This switch is the destination, so it receives from the VLAN.

Trap 3: Ingress traffic on Gi1/0/40 is forwarded to the RSPAN VLAN.

Ingress is disabled.

A
This switch receives mirrored traffic from RSPAN VLAN 300 and sends it to Gi1/0/40.
The type 'Remote Destination Session' and source RSPAN VLAN confirm this.
B
This is a local SPAN session with source VLAN 300.
Why wrong: The type is Remote Destination, not Local.
C
The RSPAN VLAN 300 is used to send traffic to a remote switch.
Why wrong: This switch is the destination, so it receives from the VLAN.
D
Ingress traffic on Gi1/0/40 is forwarded to the RSPAN VLAN.
Why wrong: Ingress is disabled.

Question 19mediummultiple choice

Given the following configuration snippet on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast

monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination interface GigabitEthernet1/0/2

What is the effect of this configuration?

Trap 1: Only traffic entering GigabitEthernet1/0/1 is copied to…

The 'both' keyword copies both directions, not just ingress.

Trap 2: Traffic on GigabitEthernet1/0/2 is replicated to…

The monitor session defines source and destination; traffic flows from source to destination, not the reverse.

Trap 3: The configuration is invalid because the destination port must be…

A SPAN destination port can be an access port; trunk mode is not required.

A
All traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.
The 'both' keyword copies both ingress and egress traffic from the source interface to the destination.
B
Only traffic entering GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.
Why wrong: The 'both' keyword copies both directions, not just ingress.
C
Traffic on GigabitEthernet1/0/2 is replicated to GigabitEthernet1/0/1.
Why wrong: The monitor session defines source and destination; traffic flows from source to destination, not the reverse.
D
The configuration is invalid because the destination port must be in trunk mode.
Why wrong: A SPAN destination port can be an access port; trunk mode is not required.

Question 20mediummultiple choice

Examine the following RSPAN configuration on a Cisco Catalyst switch:

vlan 100

name RSPAN_VLAN remote-span

monitor session 1 source vlan 10 both monitor session 1 destination remote vlan 100

Which statement about this configuration is true?

Trap 1: The destination remote vlan 100 command is incorrect; it should be…

The 'encapsulation replicate' keyword is optional and not required for the command to be valid.

Trap 2: This configuration copies traffic from VLAN 10 to the local switch…

RSPAN uses a remote VLAN to transport mirrored traffic across the network, not just locally.

Trap 3: The RSPAN VLAN 100 must be tagged on all trunk ports between…

The RSPAN VLAN must be allowed on trunk ports, but it does not require tagging; it can be native or tagged depending on configuration.

A
The RSPAN VLAN 100 must be created on all switches in the network that participate in RSPAN.
For RSPAN to work, the RSPAN VLAN must exist on all switches that forward the mirrored traffic.
B
The destination remote vlan 100 command is incorrect; it should be 'destination remote vlan 100 encapsulation replicate'.
Why wrong: The 'encapsulation replicate' keyword is optional and not required for the command to be valid.
C
This configuration copies traffic from VLAN 10 to the local switch only.
Why wrong: RSPAN uses a remote VLAN to transport mirrored traffic across the network, not just locally.
D
The RSPAN VLAN 100 must be tagged on all trunk ports between switches.
Why wrong: The RSPAN VLAN must be allowed on trunk ports, but it does not require tagging; it can be native or tagged depending on configuration.