mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Runs the following command on switch SW2: SW2#…
A network engineer runs the following command on switch SW2:
SW2# show monitor session 2
Session 2 --------- Type : Remote Source Session Source Ports : Both : Gi0/4 Source VLANs : RX Only : 100 Destination Ports : Gi0/5
Encapsulation : Native
Ingress : Disabled
Based on this output, which statement is correct?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is an RSPAN source session, and the mirrored traffic is sent to Gi0/5.
This is a remote source session (RSPAN source session). It monitors source port Gi0/4 and source VLAN 100 (RX only), and sends the mirrored traffic to destination port Gi0/5, which is typically configured as a trunk port carrying the RSPAN VLAN. The session is correctly configured for RSPAN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The session is an RSPAN source session, and the mirrored traffic is sent to Gi0/5.
Why this is correct
The type 'Remote Source Session' indicates RSPAN source, and the destination port Gi0/5 receives the mirrored traffic.
- ✗
The session is an ERSPAN source session because it monitors VLAN 100.
Why it's wrong here
ERSPAN is for IP-based encapsulation, not VLAN-based. This is RSPAN.
- ✗
The session is a local SPAN session with source VLAN.
Why it's wrong here
The type explicitly says 'Remote Source Session', not local.
- ✗
The session is misconfigured because source VLANs cannot be combined with source ports.
Why it's wrong here
RSPAN source sessions can include both source ports and source VLANs.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer runs the following command to troubleshoot an RSPAN issue: R1# show monitor session 4 detail Session 4 --------- Type : Remote Destination Session Source RSPAN VLAN : 100 Destination Ports : Gi0/2 Encapsulation : Native Ingress : Disabled What does this output indicate?
medium- ✓ A.The session is correctly configured as an RSPAN destination session.
- B.The session is misconfigured because the source must be a port, not a VLAN.
- C.The session is misconfigured because the destination port must have ingress enabled.
- D.The session is misconfigured because the RSPAN VLAN must be the same as the source VLAN.
Why A: The output shows an RSPAN destination session with source RSPAN VLAN 100 and destination port Gi0/2. This is the destination side of an RSPAN configuration.
Variation 2. A network engineer runs the following command on switch SW3: SW3# show monitor session 3 Session 3 --------- Type : Remote Destination Session Source Ports : RX Only : Gi0/6 Destination Ports : Gi0/7 Encapsulation : Native Ingress : Disabled Based on this output, which statement is correct?
medium- ✓ A.The session is an RSPAN destination session, and traffic from the RSPAN VLAN is received on Gi0/6 and sent to Gi0/7.
- B.The session is an ERSPAN destination session because it uses RX only.
- C.The session is a local SPAN session with source port Gi0/6.
- D.The session is misconfigured because the destination port has ingress disabled.
Why A: This is an RSPAN destination session. It receives mirrored traffic from the RSPAN VLAN via source port Gi0/6 (RX only) and sends it to destination port Gi0/7 for analysis. The source port is typically a trunk port carrying the RSPAN VLAN.
Variation 3. A network engineer runs the following command on switch SW6: SW6# show monitor session 8 Session 8 --------- Type : Remote Source Session Source Ports : Both : Gi0/13 Source VLANs : TX Only : 200 Destination Ports : Gi0/14 Encapsulation : Dot1q Ingress : Disabled Based on this output, which statement is correct?
hard- ✓ A.The RSPAN source session sends mirrored traffic to Gi0/14 with a Dot1q tag.
- B.The RSPAN source session sends mirrored traffic to Gi0/14 without any VLAN tag.
- C.The session is an ERSPAN source session because it uses Dot1q encapsulation.
- D.The session is misconfigured because source VLANs cannot be TX only.
Why A: This is an RSPAN source session. It monitors source port Gi0/13 and source VLAN 200 (TX only), and sends the mirrored traffic to destination port Gi0/14 with Dot1q encapsulation. The Dot1q encapsulation indicates that the destination port is a trunk port carrying the RSPAN VLAN. The session is correctly configured.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.