350-601 Security Practice Question
A VACL is configured to capture traffic between hosts in the same VLAN. The capture port is configured and the VACL is applied to the VLAN. However, no traffic is being captured. What is a likely reason?
⚠ Common exam trap
Many candidates assume a VACL applied to a VLAN will automatically send all matched traffic to a capture port, overlooking the explicit `capture` action required in the VACL configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VACL does not have a capture action
A VACL (VLAN Access Control List) must explicitly include a capture action to forward matched traffic to a capture port. Without the capture action, the VACL only permits or denies traffic within the VLAN but does not trigger packet replication to the configured capture port. The capture action is configured using the `capture` keyword in the VACL configuration, and its absence is the most common reason for no traffic being captured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VACL is applied in the wrong direction
Why it's wrong here
VACLs are applied per VLAN, not per direction; they filter all traffic within the VLAN.
- ✗
The capture port is a SPAN destination port
Why it's wrong here
SPAN and VACL capture are independent; a SPAN destination does not interfere with VACL capture.
- ✓
The VACL does not have a capture action
Why this is correct
Without the capture action, the VACL will not copy packets to the capture port.
- ✗
The capture port is not in the same VLAN
Why it's wrong here
The capture port can be in a different VLAN; it only needs to be configured as a capture port.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.