hardMultiple Choice
300-410 Practice Question: An engineer configures SPAN on a Cisco switch to…
An engineer configures SPAN on a Cisco switch to monitor traffic from a VLAN, but the VLAN includes a voice VLAN. The mirrored traffic shows only data traffic, not voice. What is the most likely explanation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SPAN source is configured for the data VLAN only, not the voice VLAN.
Voice VLANs are often configured as separate VLANs (e.g., VLAN 100 for voice, VLAN 10 for data). If the SPAN source is a single VLAN, it only captures traffic on that VLAN. To capture both, the SPAN session must include both VLANs or use a port-based source that includes both.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The SPAN source is configured for the data VLAN only, not the voice VLAN.
Why this is correct
SPAN mirrors only the interfaces or VLANs named as sources. A voice VLAN is a separate VLAN, so its traffic is never copied unless explicitly added as an additional source. The data VLAN alone therefore explains the missing voice packets.
- ✗
Voice traffic uses a different CoS value, which SPAN ignores.
Why it's wrong here
SPAN replicates frames verbatim regardless of Layer 2 CoS bits, so differing CoS values cannot cause voice packets to be omitted from the mirror. It is tempting because CoS is how voice gets prioritised, and would matter when diagnosing QoS queueing on the monitored link rather than capture completeness.
- ✗
The voice VLAN is configured as a native VLAN, which SPAN does not capture.
Why it's wrong here
SPAN sources are defined by VLAN, interface or port-channel; a native VLAN designation does not exclude that VLAN from a VLAN-based source, so voice traffic on it is still mirrored. The option is tempting because native VLAN tagging behaviour causes genuine capture confusion, and would apply when a trunk's untagged frames are missing.
- ✗
The switch has a security ACL that blocks voice traffic from being mirrored.
Why it's wrong here
ACLs filter forwarded traffic, not the SPAN copy; mirrored packets bypass egress and ingress ACL enforcement, so a security ACL cannot selectively strip voice frames. It is tempting because ACLs plausibly explain missing traffic, and would be correct if the monitoring destination port itself were administratively blocked.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.