mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Configures a SPAN port to send traffic from a…
A network engineer configures a SPAN port to send traffic from a critical server to an IDS. After configuration, the IDS sees no traffic. What is the most likely issue?
⚠ Common exam trap
Cisco often tests the distinction between source and destination misconfiguration in SPAN, trapping candidates who assume the IDS must be in the same subnet (Option A) or that VLAN tagging (Option D) would block mirrored traffic, when the real issue is an incorrect source interface specification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The monitor session source interface is incorrectly specified.
The most likely issue is that the monitor session source interface is incorrectly specified. SPAN (Switched Port Analyzer) requires the engineer to designate the correct source interface (the port connected to the critical server) and a destination interface (the port connected to the IDS). If the source interface is misconfigured—for example, pointing to the wrong switch port or using a VLAN instead of a specific port—the IDS will receive no mirrored traffic. This is a common configuration error when setting up local SPAN on Cisco switches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IDS is in a different subnet.
Why it's wrong here
SPAN is layer 2; subnet doesn't matter.
- ✓
The monitor session source interface is incorrectly specified.
Why this is correct
Common misconfiguration; wrong VLAN or port.
- ✗
The SPAN destination interface is not connected to the IDS.
Why it's wrong here
Would cause no traffic; but more specific to physical.
- ✗
The server is using VLAN tagging.
Why it's wrong here
SPAN can capture tagged traffic if configured.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.