The answer is that the VACL lacks an explicit capture action, which is required to replicate matched traffic to the capture port. Without the `capture` keyword in the VACL configuration, the access list only applies permit or deny logic to traffic within the VLAN but never triggers packet duplication to the SPAN or capture destination. This is a common oversight when troubleshooting a VACL capture action missing no traffic captured scenario, as engineers often assume that simply permitting traffic in a VACL will automatically forward it to the capture port. On the Cisco DCCOR 350-601 exam, this concept tests your understanding of how VACL capture differs from standard ACL forwarding—the capture action is a distinct operation that must be explicitly configured. A frequent trap is confusing the `permit` action with the `capture` action; remember that permit alone only allows the packet to pass through the switch, while capture tells the switch to send a copy to the monitoring port. Memory tip: “Permit passes, capture copies.”
350-601 Security Practice Question
This 350-601 practice question tests your understanding of security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A VACL is configured to capture traffic between hosts in the same VLAN. The capture port is configured and the VACL is applied to the VLAN. However, no traffic is being captured. What is a likely reason?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VACL does not have a capture action
Option C is correct because a VACL (VLANAccess Control List) must explicitly include a capture action to forward matched traffic to a capture port. Without the capture action, the VACL only permits or denies traffic within the VLAN but does not trigger packet replication to the configured capture port. The capture action is configured using the `capture` keyword in the VACL configuration, and its absence is the most common reason for no traffic being captured.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The VACL is applied in the wrong direction
Why it's wrong here
VACLs are applied per VLAN, not per direction; they filter all traffic within the VLAN.
✗
The capture port is a SPAN destination port
Why it's wrong here
SPAN and VACL capture are independent; a SPAN destination does not interfere with VACL capture.
✓
The VACL does not have a capture action
Why this is correct
Without the capture action, the VACL will not copy packets to the capture port.
Related concept
Read the scenario before looking for a memorised answer.
✗
The capture port is not in the same VLAN
Why it's wrong here
The capture port can be in a different VLAN; it only needs to be configured as a capture port.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume a VACL applied to a VLAN will automatically send all matched traffic to a capture port, overlooking the explicit `capture` action required in the VACL configuration.
Detailed technical explanation
How to think about this question
Under the hood, VACL capture uses a ternary content-addressable memory (TCAM) entry to match traffic and then replicates the packet to the capture port via a hardware forwarding path, bypassing the normal switching logic. A common real-world scenario is when an engineer configures a VACL with only `permit` or `deny` actions, expecting the capture port to automatically receive traffic, but the `capture` action is required to enable the replication. The capture action can be combined with `permit` or `deny` to selectively capture traffic that is otherwise permitted or denied.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security — This question tests Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The VACL does not have a capture action — Option C is correct because a VACL (VLAN Access Control List) must explicitly include a capture action to forward matched traffic to a capture port. Without the capture action, the VACL only permits or denies traffic within the VLAN but does not trigger packet replication to the configured capture port. The capture action is configured using the `capture` keyword in the VACL configuration, and its absence is the most common reason for no traffic being captured.
What should I do if I get this 350-601 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.