mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures a local SPAN session on a…
An engineer configures a local SPAN session on a Cisco switch to monitor all traffic on VLAN 20. The engineer uses the command 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface GigabitEthernet0/3'. The engineer connects a laptop to GigabitEthernet0/3 and runs a packet capture, but sees only traffic from the switch itself, not from other devices in VLAN 20. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SPAN session is configured to monitor only ingress traffic by default.
By default, SPAN monitors only ingress traffic on the source VLAN. To capture both directions, the command must specify 'both' for the source. The default is 'rx' only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The SPAN session is configured to monitor only ingress traffic by default.
Why this is correct
Correct because the default direction for a SPAN source VLAN is 'rx' (received traffic); to capture all traffic, the engineer must add 'both' or 'tx'.
- ✗
The destination port is in a different VLAN than the source VLAN.
Why it's wrong here
Incorrect because the destination port does not need to be in the same VLAN; it receives a copy of the traffic regardless.
- ✗
The switch does not support SPAN on VLANs.
Why it's wrong here
Incorrect because most Cisco switches support SPAN on VLANs; this is a common feature.
- ✗
The laptop is not configured to accept tagged traffic.
Why it's wrong here
Incorrect because SPAN sends untagged copies of traffic to the destination port by default; tagging is not required.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.