easyMultiple Choice
300-410 Practice Question: The default behavior of a local SPAN session if…
What is the default behavior of a local SPAN session if no direction (rx, tx, both) is specified?
⚠ Common exam trap
The trap here is assuming that no direction means no traffic or only one direction. Candidates might think that explicit configuration is required, but the default is both.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Both ingress and egress traffic are monitored.
In a local SPAN session, if no direction is specified, the default is to monitor both ingress and egress traffic. This means that all traffic entering and leaving the source interface is copied to the destination interface. The direction keyword is optional and defaults to `both`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only ingress traffic is monitored.
Why it's wrong here
Omitting the direction keyword defaults to both receive and transmit, not ingress alone. Ingress-only monitoring requires the explicit rx keyword. This option is tempting because source ports commonly capture inbound frames, but the SPAN command's default covers both directions unless rx or tx is stated.
- ✗
Only egress traffic is monitored.
Why it's wrong here
Specifying no direction in a local SPAN session defaults to monitoring both ingress and egress traffic, so restricting capture to egress alone misstates the default. Egress-only monitoring is configured deliberately when you need to inspect traffic leaving an interface, such as validating outbound filtering or egress policing, rather than the bidirectional default.
- ✓
Both ingress and egress traffic are monitored.
Why this is correct
Cisco IOS defaults a local SPAN session to monitor both directions when no keyword is given, so ingress and egress frames on the source interface are copied to the destination port. Specifying rx or tx narrows this; omitting direction satisfies the stem's default-behaviour constraint.
- ✗
No traffic is monitored until direction is explicitly set.
Why it's wrong here
A local SPAN session with no direction keyword defaults to monitoring both ingress and egress traffic, so monitoring does not remain inactive. Explicitly setting a direction is optional, not mandatory. This option is tempting because direction parameters exist and can be omitted, but omission selects the both default rather than disabling the session.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.