hardMultiple Choice
300-410 Practice Question: A switch is configured with RSPAN to monitor…
A switch is configured with RSPAN to monitor traffic from VLAN 50 to a remote switch via VLAN 200. The source switch has: monitor session 1 source vlan 50 rx monitor session 1 destination remote vlan 200. The remote switch has: monitor session 2 source remote vlan 200 monitor session 2 destination interface Gi0/2. The intermediate switches have VLAN 200 configured with 'remote-span'. The network uses VTP transparent mode. The analyzer connected to Gi0/2 sees intermittent traffic. The RSPAN VLAN 200 is also used as a native VLAN on some trunk ports. What is the likely cause of intermittent traffic?
⚠ Common exam trap
300-410 often tests the interaction between RSPAN and native VLAN configuration — candidates focus on VTP mode or trunk allowed VLANs but miss that using the RSPAN VLAN as a native VLAN breaks tagging and causes intermittent mirroring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RSPAN VLAN 200 is also the native VLAN on some trunks, causing the mirrored frames to be sent untagged and possibly dropped.
When the RSPAN VLAN is also configured as the native VLAN on a trunk, mirrored frames are sent untagged on that trunk. Intermediate switches may treat untagged frames as belonging to the native VLAN rather than the RSPAN VLAN, causing them to be forwarded incorrectly or dropped, resulting in intermittent traffic at the destination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The RSPAN VLAN 200 is also the native VLAN on some trunks, causing the mirrored frames to be sent untagged and possibly dropped.
Why this is correct
RSPAN traffic must remain tagged with the dedicated RSPAN VLAN across every trunk; using VLAN 200 as a native VLAN strips that tag on those links, so intermediate switches cannot identify the frames as RSPAN and drop them, producing the intermittent capture. The RSPAN VLAN must be reserved and never used as a native VLAN.
- ✗
VTP transparent mode prevents RSPAN from working correctly.
Why it's wrong here
VTP transparent mode still propagates and supports RSPAN VLANs; it merely stops the switch participating in VTP domain advertisements. Transparent mode is the right answer when the question concerns local VLAN database independence from VTP server updates.
- ✗
The source VLAN 50 is not allowed on the trunk ports.
Why it's wrong here
VLAN 50 is the source, not the RSPAN transport; if it were disallowed on trunks, monitoring would fail entirely rather than intermittently. Verifying source VLAN trunk allowance is correct when no traffic reaches the destination at all.
- ✗
The monitor session 2 is missing the 'no shutdown' command.
Why it's wrong here
Monitor sessions and destination interfaces are enabled by default, so 'no shutdown' is not required; the intermittent symptom stems from VLAN 200 also serving as native VLAN on trunks, which strips or misforwards tagged RSPAN traffic. The command would matter only if the interface were administratively down.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.