mediumMultiple Choice
300-410 Practice Question: Runs the following command on router R4: R4# show…
A network engineer runs the following command on router R4:
R4# show monitor session 9
Session 9 --------- Type : ERSPAN Source Session Status : Admin Disabled Source Ports : Both : Gi0/2 Destination IP : 192.168.2.20 Origin IP : 10.0.0.3 ERSPAN ID : 200
Based on this output, which statement is correct?
⚠ Common exam trap
The trap here is that candidates might assume the session is active simply because it is configured, ignoring the 'Admin Disabled' status, or they might confuse ERSPAN with RSPAN due to the disabled state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ERSPAN session is configured but not currently active because it is administratively disabled.
The output explicitly shows 'Status : Admin Disabled', which means the ERSPAN source session has been configured but has not been activated by the administrator. In Cisco IOS, an ERSPAN session remains in this state until the 'no shutdown' command is issued under the monitor session configuration. Therefore, the session is not currently mirroring traffic, making option A the correct statement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ERSPAN session is configured but not currently active because it is administratively disabled.
Why this is correct
The output shows Status: Admin Disabled, meaning the ERSPAN source session exists in configuration but has been shut down administratively. Because of that disabled state, no traffic is mirrored from Gi0/2 to destination IP 192.168.2.20, despite the session parameters being present.
- ✗
The ERSPAN session is actively mirroring traffic from Gi0/2 to 192.168.2.20.
Why it's wrong here
The status line reads Admin Disabled, so no traffic is mirrored to 192.168.2.20 despite the configured source and destination. It is tempting because the session's parameters are fully populated and syntactically valid, and ERSPAN source sessions do forward to a destination IP once administratively enabled.
- ✗
The ERSPAN session is using RSPAN because the status is disabled.
Why it's wrong here
The session type is ERSPAN Source Session; RSPAN uses VLAN-based remote spanning with a dedicated RSPAN VLAN, not an IP destination. It is tempting because both are remote mirroring variants and the disabled status suggests something is wrong, but administrative state does not determine the mirroring technology.
- ✗
The ERSPAN session is misconfigured because the origin IP is missing.
Why it's wrong here
An origin IP of 10.0.0.3 is present in the output, so the session is not missing it. It is tempting because ERSPAN requires a source address for the GRE-encapsulated packets, and a genuinely absent origin IP would be a configuration fault. Here the actual fault is the Admin Disabled status.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.