mediumMultiple Choice
300-410 Practice Question: Runs the following command on router R3: R3# show…
A network engineer runs the following command on router R3:
R3# show monitor session 5
Session 5 --------- Type : ERSPAN Destination Session Status : Admin Enabled Source IP : 10.0.0.2 Destination Ports : Gi0/1
Encapsulation : Native
Ingress : Disabled ERSPAN ID : 100
Based on this output, which statement is correct?
⚠ Common exam trap
300-410 often tests directionality in ERSPAN output — candidates misread 'Source IP' as the destination of mirrored traffic rather than the origin, and they misinterpret 'Ingress: Disabled' as an error when it is standard practice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ERSPAN destination session receives traffic from source IP 10.0.0.2 and sends it to Gi0/1.
The output shows 'Type: ERSPAN Destination Session' with 'Source IP: 10.0.0.2' and 'Destination Ports: Gi0/1'. In an ERSPAN destination session, the switch receives GRE-encapsulated mirrored traffic from the source IP (the ERSPAN source session's origin) and forwards the decapsulated traffic out the destination port Gi0/1. Therefore, the session receives traffic from 10.0.0.2 and sends it to Gi0/1.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ERSPAN destination session receives traffic from source IP 10.0.0.2 and sends it to Gi0/1.
Why this is correct
ERSPAN destination sessions decapsulate GRE-encapsulated traffic arriving from the configured source IP and forward the original frames out the destination port. Here, packets from 10.0.0.2 are stripped of their ERSPAN header and transmitted via Gi0/1, satisfying the session's role as the receiving endpoint.
- ✗
The ERSPAN destination session sends traffic to source IP 10.0.0.2.
Why it's wrong here
The source IP 10.0.0.2 is the ERSPAN source that sends encapsulated traffic to this destination session; the destination port Gi0/1 receives it. Traffic flows from that IP, not to it. It is tempting because source and destination labels can be read backwards, but the direction is reversed here.
- ✗
The session is an RSPAN destination session because it uses a destination port.
Why it's wrong here
The output explicitly states Type: ERSPAN Destination Session, so it is not RSPAN. RSPAN uses VLAN-based transport, not an IP source. It is tempting because both use a destination port, but the session type and source IP identify ERSPAN, making this statement incorrect.
- ✗
The session is misconfigured because the destination port has ingress disabled.
Why it's wrong here
Ingress disabled is normal for an ERSPAN destination session; the destination port only transmits monitored traffic, so ingress is intentionally off. Nothing is misconfigured. It is tempting because disabled ingress looks like a fault, but on a destination session it is the expected, correct state.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.