This 200-201 practice question tests your understanding of security monitoring. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network engineer configures a SPAN port to send traffic from a critical server to an IDS. After configuration, the IDS sees no traffic. What is the most likely issue?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
The IDS is in a different subnet.
Why wrong: SPAN is layer 2; subnet doesn't matter.
The monitor session source interface is incorrectly specified.
Common misconfiguration; wrong VLAN or port.
The SPAN destination interface is not connected to the IDS.
Why wrong: Would cause no traffic; but more specific to physical.
The server is using VLAN tagging.
Why wrong: SPAN can capture tagged traffic if configured.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
The monitor session source interface is incorrectly specified.
The most likely issue is that the monitor session source interface is incorrectly specified. SPAN (Switched Port Analyzer) requires the engineer to designate the correct source interface (the port connected to the critical server) and a destination interface (the port connected to the IDS). If the source interface is misconfigured—for example, pointing to the wrong switch port or using a VLAN instead of a specific port—the IDS will receive no mirrored traffic. This is a common configuration error when setting up local SPAN on Cisco switches.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
The IDS is in a different subnet.
Why it's wrong here
SPAN is layer 2; subnet doesn't matter.
The monitor session source interface is incorrectly specified.
Why this is correct
Common misconfiguration; wrong VLAN or port.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
The SPAN destination interface is not connected to the IDS.
Why it's wrong here
Would cause no traffic; but more specific to physical.
The server is using VLAN tagging.
Why it's wrong here
SPAN can capture tagged traffic if configured.
Common exam traps
Cisco often tests the distinction between source and destination misconfiguration in SPAN, trapping candidates who assume the IDS must be in the same subnet (Option A) or that VLAN tagging (Option D) would block mirrored traffic, when the real issue is an incorrect source interface specification.
Detailed technical explanation
SPAN (per IEEE 802.1Q and Cisco proprietary) copies Ethernet frames from a source port or VLAN to a destination port for analysis. The monitor session command (e.g., 'monitor session 1 source interface GigabitEthernet0/1 both') must match the exact port connected to the server; a common mistake is specifying the wrong port number or using a VLAN source when a specific port is needed. In real-world deployments, engineers often forget that SPAN does not affect the original traffic flow—it only duplicates frames—so misconfiguration of the source is the primary cause of missing traffic at the IDS.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Monitoring — study guide chapter
Learn the concepts, then practise the questions
Security Monitoring practice questions
Targeted practice on this topic area only
All 200-201 questions
507 questions across all exam domains
Cisco CyberOps Associate 200-201 study guide
Full concept coverage aligned to exam objectives
200-201 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-201 questions linked to Security Policies and Procedures.
Practise 200-201 questions linked to Security Concepts.
Practise 200-201 questions linked to Security Monitoring.
Practise 200-201 questions linked to Host-Based Analysis.
Practise 200-201 questions linked to Network Intrusion Analysis.
Practise 200-201 questions linked to 200-201 fundamentals.
Practise 200-201 questions linked to 200-201 scenario.
Practise 200-201 questions linked to 200-201 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Security Monitoring — This question tests Security Monitoring — Read the scenario before looking for a memorised answer..
The correct answer is: The monitor session source interface is incorrectly specified. — The most likely issue is that the monitor session source interface is incorrectly specified. SPAN (Switched Port Analyzer) requires the engineer to designate the correct source interface (the port connected to the critical server) and a destination interface (the port connected to the IDS). If the source interface is misconfigured—for example, pointing to the wrong switch port or using a VLAN instead of a specific port—the IDS will receive no mirrored traffic. This is a common configuration error when setting up local SPAN on Cisco switches.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.