200-201 Security Monitoring Practice Question
A network security analyst is configuring a SPAN session on a Cisco switch so that a Cisco Firepower sensor can inspect traffic between the internal user VLAN and the internet-facing router. The switch has a single physical uplink carrying that traffic. Which configuration goal must the analyst keep in mind to ensure the sensor receives complete sessions?
⚠ Common exam trap
The trap here is focusing on destination-port settings like trunking or VLAN tag replication, when the actual determinant of complete session capture is mirroring both directions at the SPAN source.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SPAN source must include both transmit and receive directions of the monitored interface.
Session reassembly requires visibility into both directions of a conversation. When a SPAN source mirrors only one direction, the sensor sees SYN packets without replies or requests without responses, crippling detection and logging. Configuring the source to capture both transmit and receive traffic on the monitored interface ensures the sensor receives full bidirectional sessions for accurate analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The sensor interface must be set to promiscuous mode and assigned an IP address on the monitored VLAN.
Why it's wrong here
Promiscuous mode is necessary for the sensor to accept frames not addressed to it, but assigning an IP address on the monitored VLAN is not required for passive inspection and can even introduce unnecessary traffic. Passive monitoring interfaces typically operate without an IP address, so this configuration step does not contribute to capturing complete sessions.
- ✗
The SPAN session must be configured with the encapsulation replicate option to copy VLAN tags.
Why it's wrong here
Encapsulation replicate preserves VLAN tag information in the mirrored frames, which can help with VLAN identification, but it does not determine whether both directions of a session are captured. The completeness of a session depends on mirroring both ingress and egress traffic from the source interface, not on tag replication.
- ✓
The SPAN source must include both transmit and receive directions of the monitored interface.
Why this is correct
To reconstruct complete TCP sessions, the sensor needs to see packets flowing in both directions. If only one direction is mirrored, the sensor sees half-conversations, which degrades detection and can prevent session reassembly. Configuring the source interface to capture both ingress and egress traffic is therefore the essential requirement for this deployment.
- ✗
The SPAN destination port must be configured as a trunk carrying all VLANs.
Why it's wrong here
A SPAN destination port normally cannot participate in normal switching and simply replicates monitored frames, so making it a trunk is neither required nor typically supported for this purpose. The monitoring goal is to receive both directions of each session, which depends on the source configuration, not on tagging the destination port with all VLANs.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.