mediumMultiple Choice
300-410 Practice Question: Runs the following command on switch SW1: SW1#…
A network engineer runs the following command on switch SW1:
SW1# show monitor session 1
Session 1 --------- Type : Local Session Source Ports : Both : Gi0/1, Gi0/2 Destination Ports : Gi0/3
Encapsulation : Native
Ingress : Disabled
Based on this output, which statement is correct?
⚠ Common exam trap
The trap is misreading the direction of the SPAN relationship — candidates often swap source and destination ports, or misinterpret 'Ingress : Disabled' as a fault rather than a normal destination-port setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SPAN session is monitoring traffic on Gi0/1 and Gi0/2 and sending it to Gi0/3.
In the SPAN output, the 'Source Ports' section lists Gi0/1 and Gi0/2 with 'Both' direction, meaning traffic in both ingress and egress directions on those ports is copied. The 'Destination Ports' section lists Gi0/3, which is where the mirrored traffic is sent for analysis. Therefore, the session monitors Gi0/1 and Gi0/2 and forwards copies to Gi0/3.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The SPAN session is monitoring traffic on Gi0/1 and Gi0/2 and sending it to Gi0/3.
Why this is correct
The output lists source ports Gi0/1 and Gi0/2 under "Both", meaning ingress and egress traffic on those ports is copied, and Gi0/3 as the destination port with native encapsulation. Monitored frames are therefore forwarded out Gi0/3.
- ✗
The SPAN session is monitoring traffic on Gi0/3 and sending it to Gi0/1 and Gi0/2.
Why it's wrong here
The output lists Gi0/1 and Gi0/2 under Source Ports and Gi0/3 as the Destination Port, so traffic flows from the monitored ports to Gi0/3, not the reverse. Reversing source and destination is tempting because both directions appear in the session.
- ✗
The SPAN session is using RSPAN because the destination port has ingress disabled.
Why it's wrong here
The session type is explicitly Local Session, and RSPAN requires a remote VLAN and reflector configuration; ingress being disabled on the destination port is normal for SPAN and unrelated to RSPAN. RSPAN would be correct when monitored traffic must cross to a switch that is not directly connected.
- ✗
The SPAN session is not active because the destination port is not in forwarding state.
Why it's wrong here
The output shows an active session with source and destination ports configured; a destination port's forwarding state is not displayed here and is not a prerequisite for the session to exist. This reasoning would apply only if the output explicitly reported the session as down or inactive.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.