hardMultiple Choice
300-410 Practice Question: Runs the following command to troubleshoot an…
A network engineer runs the following command to troubleshoot an ERSPAN issue:
R1# show monitor session 6 detail
Session 6 --------- Type : ERSPAN Source Session Source VLANs : Both : 10-20 Destination IP : 10.1.1.3 ERSPAN ID : 200
What does this output indicate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is correctly configured to monitor VLANs 10 through 20.
The output shows an ERSPAN source session with source VLANs 10-20, destination IP 10.1.1.3, and ERSPAN ID 200. This is a valid ERSPAN source session using VLANs as the source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The session is correctly configured to monitor VLANs 10 through 20.
Why this is correct
Monitoring both VLANs 10–20 satisfies the source specification, and the destination IP plus ERSPAN ID confirm the session is fully defined. Because ERSPAN encapsulates mirrored traffic in GRE for routed transport, the source session needs no local destination interface — so this output shows a valid, complete configuration.
- ✗
The session is misconfigured because ERSPAN cannot use VLANs as source.
Why it's wrong here
ERSPAN source sessions can monitor VLANs, including both directions, so using VLANs 10-20 as the source is valid. The claim is tempting because ERSPAN encapsulates traffic in GRE, but that encapsulation concerns the destination, not whether VLANs can be monitored.
- ✗
The session is misconfigured because the ERSPAN ID must be less than 100.
Why it's wrong here
ERSPAN IDs are 10-bit fields, so values up to 1023 are valid; 200 is accepted and the session is not misconfigured on that basis. The claim is tempting because ERSPAN IDs are often written as small numbers, but the range genuinely permits 1 through 1023.
- ✗
The session is misconfigured because the destination IP must be on the same subnet.
Why it's wrong here
ERSPAN tunnels monitored traffic in GRE to the destination IP, which is routed and need not share a subnet with the source. The claim is tempting because local SPAN destinations are interfaces, but ERSPAN's whole purpose is crossing Layer 3 boundaries.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.