mediumMultiple Choice
300-410 Practice Question: Runs the following command on router R2: R2# show…
A network engineer runs the following command on router R2:
R2# show monitor session 4
Session 4 --------- Type : ERSPAN Source Session Status : Admin Enabled Source Ports : Both : Gi0/0 Destination IP : 192.168.1.10 Origin IP : 10.0.0.2 ERSPAN ID : 100
Based on this output, which statement is correct?
⚠ Common exam trap
The trap is misreading the direction of the mirror — candidates see the destination IP and assume traffic flows from that IP to the port, but ERSPAN source sessions mirror from the source port to the destination IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ERSPAN session is mirroring traffic from Gi0/0 to IP address 192.168.1.10 using ERSPAN ID 100.
The output shows an ERSPAN Source Session with Source Port Gi0/0 and Destination IP 192.168.1.10, meaning traffic from Gi0/0 is mirrored to the destination IP using ERSPAN ID 100. ERSPAN encapsulates mirrored traffic in GRE and sends it to a remote destination IP, which matches this output.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ERSPAN session is mirroring traffic from Gi0/0 to IP address 192.168.1.10 using ERSPAN ID 100.
Why this is correct
The session is an ERSPAN source, so it encapsulates mirrored frames from Gi0/0 into GRE and forwards them to the destination IP 192.168.1.10, tagged with ERSPAN ID 100. This satisfies the stem's requirement to identify the mirroring direction and destination, since source sessions transmit rather than receive traffic.
- ✗
The ERSPAN session is mirroring traffic from IP 192.168.1.10 to Gi0/0.
Why it's wrong here
The output names Gi0/0 as the source port and 192.168.1.10 as the destination IP, so traffic flows from Gi0/0 towards that IP, not the reverse. It is tempting because source and destination labels can be read either way, and would be correct if the destination IP were listed under Source Ports.
- ✗
The ERSPAN session is using RSPAN encapsulation.
Why it's wrong here
The session type is ERSPAN, which encapsulates mirrored traffic in GRE for routed transport; RSPAN instead uses a dedicated VLAN to carry mirrored frames across switches. It is tempting because both are remote mirroring technologies, and RSPAN would be correct where the destination is reached over a Layer 2 trunk rather than IP.
- ✗
The ERSPAN session is disabled because the status is 'Admin Enabled'.
Why it's wrong here
'Admin Enabled' means the session is administratively enabled, not disabled; the status field confirms the session is active. It is tempting because the word 'Admin' can suggest an administrative hold, and would be correct if the status read 'Admin Disabled' or the session were shut down.
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.