SPAN, RSPAN, and ERSPAN practice questions

A network engineer configures SPAN on a Cisco Catalyst switch to monitor traffic between two hosts. The engineer configures the source interface as GigabitEthernet0/1 and the destination interface as GigabitEthernet0/2. After the configuration, the engineer notices that the monitored traffic is not being forwarded to the destination port. What is the most likely cause?

Trap 1: The destination port is not in the same VLAN as the source port.

Incorrect because SPAN can monitor traffic across different VLANs; the destination port does not need to be in the same VLAN.

Trap 2: The destination port is configured as a trunk port.

Incorrect because a trunk port can be a SPAN destination; this would not prevent traffic forwarding.

Trap 3: The source interface is not in the same VLAN as the destination…

Incorrect because SPAN does not require the source and destination to be in the same VLAN; the destination port simply receives a copy of the traffic.

A
The destination port is not in the same VLAN as the source port.
Why wrong: Incorrect because SPAN can monitor traffic across different VLANs; the destination port does not need to be in the same VLAN.
B
The destination port is configured as a trunk port.
Why wrong: Incorrect because a trunk port can be a SPAN destination; this would not prevent traffic forwarding.
C
The destination port is in a blocking state due to Spanning Tree Protocol.
Correct because SPAN destination ports are not expected to participate in STP; they should be configured with 'spanning-tree portfast' to avoid blocking.
D
The source interface is not in the same VLAN as the destination interface.
Why wrong: Incorrect because SPAN does not require the source and destination to be in the same VLAN; the destination port simply receives a copy of the traffic.

Question 2mediummultiple choice

An engineer configures RSPAN on a Cisco switch to monitor traffic from VLAN 10 across multiple switches. The engineer creates an RSPAN VLAN (VLAN 100) on the source switch and configures the source as VLAN 10. On the remote switch, the engineer configures the destination port as GigabitEthernet0/1 in VLAN 100. However, the destination port does not forward any monitored traffic. What is the most likely cause?

Trap 1: The destination port is configured as an access port in VLAN 100.

Incorrect because the destination port should be in the RSPAN VLAN, but that alone does not cause the issue; the traffic must first reach the remote switch.

Trap 2: The source switch does not have the RSPAN VLAN configured as a…

Incorrect because the RSPAN VLAN is created with the 'remote-span' command; missing this would cause a different error, but the primary issue here is trunking.

Trap 3: The destination port is not configured with 'monitor session' on…

Incorrect because the destination port is configured, but the traffic must first be delivered via the RSPAN VLAN.

A
The RSPAN VLAN is not allowed on the trunk links between the switches.
Correct because the RSPAN VLAN must be permitted on all intermediate trunks for the monitored traffic to traverse the network.
B
The destination port is configured as an access port in VLAN 100.
Why wrong: Incorrect because the destination port should be in the RSPAN VLAN, but that alone does not cause the issue; the traffic must first reach the remote switch.
C
The source switch does not have the RSPAN VLAN configured as a remote-span VLAN.
Why wrong: Incorrect because the RSPAN VLAN is created with the 'remote-span' command; missing this would cause a different error, but the primary issue here is trunking.
D
The destination port is not configured with 'monitor session' on the remote switch.
Why wrong: Incorrect because the destination port is configured, but the traffic must first be delivered via the RSPAN VLAN.

Review the full routing breakdown →

Question 3hardmultiple choice

A network engineer is troubleshooting an ERSPAN configuration where traffic from a source router is being sent to a remote monitoring server. The engineer configures an ERSPAN source session on Router A to capture traffic on GigabitEthernet0/0 and send it to the IP address 10.1.1.100. The monitoring server does not receive any packets. The engineer verifies that IP connectivity exists between Router A and the server. What is the most likely cause?

Trap 1: The monitoring server is not listening on the correct UDP port.

Incorrect because ERSPAN uses GRE encapsulation, not UDP; the server must be able to decapsulate GRE packets.

Trap 2: The source interface is not in the same subnet as the destination…

Incorrect because IP connectivity is verified; the issue is not about subnet matching.

Trap 3: The ERSPAN session is configured with the wrong source IP address.

Incorrect because the source IP is used for the tunnel; while possible, the primary missing element is the tunnel interface itself.

A
The ERSPAN session is missing a tunnel interface configuration.
Correct because ERSPAN encapsulates monitored traffic in GRE tunnels; a tunnel interface must be configured and referenced in the monitor session.
B
The monitoring server is not listening on the correct UDP port.
Why wrong: Incorrect because ERSPAN uses GRE encapsulation, not UDP; the server must be able to decapsulate GRE packets.
C
The source interface is not in the same subnet as the destination IP.
Why wrong: Incorrect because IP connectivity is verified; the issue is not about subnet matching.
D
The ERSPAN session is configured with the wrong source IP address.
Why wrong: Incorrect because the source IP is used for the tunnel; while possible, the primary missing element is the tunnel interface itself.

Question 4mediummultiple choice

An engineer configures a local SPAN session on a Cisco switch to monitor all traffic on VLAN 20. The engineer uses the command 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface GigabitEthernet0/3'. The engineer connects a laptop to GigabitEthernet0/3 and runs a packet capture, but sees only traffic from the switch itself, not from other devices in VLAN 20. What is the most likely cause?

Trap 1: The destination port is in a different VLAN than the source VLAN.

Incorrect because the destination port does not need to be in the same VLAN; it receives a copy of the traffic regardless.

Trap 2: The switch does not support SPAN on VLANs.

Incorrect because most Cisco switches support SPAN on VLANs; this is a common feature.

Trap 3: The laptop is not configured to accept tagged traffic.

Incorrect because SPAN sends untagged copies of traffic to the destination port by default; tagging is not required.

A
The SPAN session is configured to monitor only ingress traffic by default.
Correct because the default direction for a SPAN source VLAN is 'rx' (received traffic); to capture all traffic, the engineer must add 'both' or 'tx'.
B
The destination port is in a different VLAN than the source VLAN.
Why wrong: Incorrect because the destination port does not need to be in the same VLAN; it receives a copy of the traffic regardless.
C
The switch does not support SPAN on VLANs.
Why wrong: Incorrect because most Cisco switches support SPAN on VLANs; this is a common feature.
D
The laptop is not configured to accept tagged traffic.
Why wrong: Incorrect because SPAN sends untagged copies of traffic to the destination port by default; tagging is not required.

Question 5hardmultiple choice

A network engineer configures an RSPAN session on Switch A to monitor traffic from interface GigabitEthernet0/1 and sends it to Switch B. The engineer creates RSPAN VLAN 50 on both switches and configures the trunk between them to allow VLAN 50. On Switch B, the engineer configures the destination port as GigabitEthernet0/2 in VLAN 50. The engineer notices that the destination port is not forwarding any traffic. What should the engineer check first?

Trap 1: Check that the destination port is not in a shutdown state.

Incorrect because the port is likely up; the issue is more specific to RSPAN configuration.

Trap 2: Ensure that the source interface is not configured with 'no monitor…

Incorrect because the session is configured; the problem is on the RSPAN VLAN itself.

Trap 3: Confirm that the trunk between switches is configured as a dot1q…

Incorrect because the trunk is already configured to allow VLAN 50; the missing 'remote-span' is the likely cause.

A
Verify that the RSPAN VLAN is configured with the 'remote-span' command on both switches.
Correct because the 'remote-span' command is essential to designate the VLAN as an RSPAN VLAN; without it, the VLAN behaves as a normal VLAN.
B
Check that the destination port is not in a shutdown state.
Why wrong: Incorrect because the port is likely up; the issue is more specific to RSPAN configuration.
C
Ensure that the source interface is not configured with 'no monitor session'.
Why wrong: Incorrect because the session is configured; the problem is on the RSPAN VLAN itself.
D
Confirm that the trunk between switches is configured as a dot1q trunk.
Why wrong: Incorrect because the trunk is already configured to allow VLAN 50; the missing 'remote-span' is the likely cause.

Question 6hardmultiple choice

An engineer configures ERSPAN on a Cisco router to monitor traffic on interface GigabitEthernet0/0/0 and send it to a monitoring server at 192.168.1.100. The engineer configures the ERSPAN session with a tunnel source of 10.0.0.1 and a tunnel destination of 192.168.1.100. The monitoring server receives no packets. The engineer pings 192.168.1.100 from the router and succeeds. What is the most likely cause?

Trap 1: The ERSPAN session is configured with the wrong direction.

Incorrect because ERSPAN captures traffic bidirectionally by default; direction is not the issue.

Trap 2: The router does not support ERSPAN.

Incorrect because the engineer configured it; the issue is likely a routing problem.

Trap 3: The monitoring server is not listening on the correct TCP port.

Incorrect because ERSPAN uses GRE, not TCP; the server must support GRE decapsulation.

A
The monitoring server does not have a route to the tunnel source IP 10.0.0.1.
Correct because the server needs to be able to respond to or process GRE packets; if it cannot reach the tunnel source, the packets may be discarded.
B
The ERSPAN session is configured with the wrong direction.
Why wrong: Incorrect because ERSPAN captures traffic bidirectionally by default; direction is not the issue.
C
The router does not support ERSPAN.
Why wrong: Incorrect because the engineer configured it; the issue is likely a routing problem.
D
The monitoring server is not listening on the correct TCP port.
Why wrong: Incorrect because ERSPAN uses GRE, not TCP; the server must support GRE decapsulation.

Question 7mediummultiple choice

A network engineer configures a SPAN session on a Cisco switch to monitor traffic on interface GigabitEthernet0/1 and sends it to interface GigabitEthernet0/2. The engineer notices that the destination port is up but does not forward any traffic. The engineer checks the configuration and sees that the destination port is configured as a trunk port. What is the most likely cause?

Trap 1: The source interface is in a different VLAN than the destination…

Incorrect because SPAN does not require the source and destination to be in the same VLAN.

Trap 2: The SPAN session is configured with the 'rx' direction only.

Incorrect because even 'rx' direction should still forward traffic; the issue is the trunk configuration.

Trap 3: The destination port is not in the same VLAN as the source…

Incorrect because the destination port does not need to be in any specific VLAN; it receives a copy of the traffic.

A
The destination port is configured as a trunk port instead of an access port.
Correct because SPAN destination ports should be access ports; trunk ports are not supported for SPAN destinations on most platforms.
B
The source interface is in a different VLAN than the destination interface.
Why wrong: Incorrect because SPAN does not require the source and destination to be in the same VLAN.
C
The SPAN session is configured with the 'rx' direction only.
Why wrong: Incorrect because even 'rx' direction should still forward traffic; the issue is the trunk configuration.
D
The destination port is not in the same VLAN as the source interface.
Why wrong: Incorrect because the destination port does not need to be in any specific VLAN; it receives a copy of the traffic.

Question 8hardmultiple choice

An engineer configures an RSPAN session on a Cisco switch to monitor traffic from VLAN 30 and send it to a remote switch. The engineer creates RSPAN VLAN 200 on both switches and configures the trunk to allow VLAN 200. On the remote switch, the engineer configures the destination port as GigabitEthernet0/4 in VLAN 200. The engineer notices that the destination port is forwarding traffic, but the traffic is not from the source VLAN 30; instead, it is broadcast traffic from other VLANs. What is the most likely cause?

Trap 1: The source VLAN is not configured correctly on the source switch.

Incorrect because the source VLAN is configured; the issue is that the RSPAN VLAN is carrying extra traffic.

Trap 2: The destination port is in the wrong VLAN.

Incorrect because the destination port is in VLAN 200, but the problem is that VLAN 200 is not isolated.

Trap 3: The trunk is not pruning VLAN 200 correctly.

Incorrect because pruning is not the issue; the VLAN is allowed, but it is carrying extra traffic due to misconfiguration.

A
The RSPAN VLAN is also being used for other VLAN traffic due to misconfiguration.
Correct because the RSPAN VLAN should be a dedicated VLAN; if it is also used as a native VLAN or for other traffic, it will carry unwanted broadcasts.
B
The source VLAN is not configured correctly on the source switch.
Why wrong: Incorrect because the source VLAN is configured; the issue is that the RSPAN VLAN is carrying extra traffic.
C
The destination port is in the wrong VLAN.
Why wrong: Incorrect because the destination port is in VLAN 200, but the problem is that VLAN 200 is not isolated.
D
The trunk is not pruning VLAN 200 correctly.
Why wrong: Incorrect because pruning is not the issue; the VLAN is allowed, but it is carrying extra traffic due to misconfiguration.

Question 9hardmultiple choice

A network engineer configures an ERSPAN session on a Cisco router to monitor traffic on interface GigabitEthernet0/0/0 and send it to a monitoring server at 172.16.1.100. The engineer uses the command 'monitor session 1 type erspan-source' and configures the tunnel. The monitoring server receives packets, but the packets contain only the original source and destination IP addresses of the monitored traffic, not the encapsulated GRE headers. What is the most likely cause?

Trap 1: The monitoring server is stripping the GRE headers before capturing.

Incorrect because the server would need to decapsulate; the issue is that the router is not encapsulating.

Trap 2: The ERSPAN session is configured with the 'ip access-group' command…

Incorrect because access-lists could drop packets, but they would not cause the router to send raw packets.

Trap 3: The router is not running the correct IOS version that supports…

Incorrect because the session was configured; the issue is likely a configuration error, not a software limitation.

A
The ERSPAN session is misconfigured, causing the router to forward the original packets instead of encapsulated copies.
Correct because the router should send GRE-encapsulated packets; if it sends raw packets, the session configuration is incorrect.
B
The monitoring server is stripping the GRE headers before capturing.
Why wrong: Incorrect because the server would need to decapsulate; the issue is that the router is not encapsulating.
C
The ERSPAN session is configured with the 'ip access-group' command that filters the encapsulated traffic.
Why wrong: Incorrect because access-lists could drop packets, but they would not cause the router to send raw packets.
D
The router is not running the correct IOS version that supports ERSPAN.
Why wrong: Incorrect because the session was configured; the issue is likely a configuration error, not a software limitation.

Question 10mediummultiple choice

A network engineer runs the following command on switch SW1:

SW1# show monitor session 1

Session 1 --------- Type : Local Session Source Ports : Both : Gi0/1, Gi0/2 Destination Ports : Gi0/3

Encapsulation : Native

Ingress : Disabled

Based on this output, which statement is correct?

Trap 1: The SPAN session is monitoring traffic on Gi0/3 and sending it to…

Source and destination are reversed; Gi0/1 and Gi0/2 are sources, Gi0/3 is destination.

Trap 2: The SPAN session is using RSPAN because the destination port has…

RSPAN uses a VLAN as the destination, not a port. Ingress disabled is typical for local SPAN destination ports.

Trap 3: The SPAN session is not active because the destination port is not…

The output does not indicate any error; the session is active and configured.

A
The SPAN session is monitoring traffic on Gi0/1 and Gi0/2 and sending it to Gi0/3.
The output clearly shows source ports Gi0/1 and Gi0/2, destination port Gi0/3, and type Local Session, confirming this.
B
The SPAN session is monitoring traffic on Gi0/3 and sending it to Gi0/1 and Gi0/2.
Why wrong: Source and destination are reversed; Gi0/1 and Gi0/2 are sources, Gi0/3 is destination.
C
The SPAN session is using RSPAN because the destination port has ingress disabled.
Why wrong: RSPAN uses a VLAN as the destination, not a port. Ingress disabled is typical for local SPAN destination ports.
D
The SPAN session is not active because the destination port is not in forwarding state.
Why wrong: The output does not indicate any error; the session is active and configured.

Question 11mediummultiple choice

A network engineer runs the following command on switch SW2:

SW2# show monitor session 2

Session 2 --------- Type : Remote Source Session Source Ports : Both : Gi0/4 Source VLANs : RX Only : 100 Destination Ports : Gi0/5

Encapsulation : Native

Ingress : Disabled

Based on this output, which statement is correct?

Trap 1: The session is an ERSPAN source session because it monitors VLAN…

ERSPAN is for IP-based encapsulation, not VLAN-based. This is RSPAN.

Trap 2: The session is a local SPAN session with source VLAN.

The type explicitly says 'Remote Source Session', not local.

Trap 3: The session is misconfigured because source VLANs cannot be…

RSPAN source sessions can include both source ports and source VLANs.

A
The session is an RSPAN source session, and the mirrored traffic is sent to Gi0/5.
The type 'Remote Source Session' indicates RSPAN source, and the destination port Gi0/5 receives the mirrored traffic.
B
The session is an ERSPAN source session because it monitors VLAN 100.
Why wrong: ERSPAN is for IP-based encapsulation, not VLAN-based. This is RSPAN.
C
The session is a local SPAN session with source VLAN.
Why wrong: The type explicitly says 'Remote Source Session', not local.
D
The session is misconfigured because source VLANs cannot be combined with source ports.
Why wrong: RSPAN source sessions can include both source ports and source VLANs.

Question 12mediummultiple choice

A network engineer runs the following command on switch SW3:

SW3# show monitor session 3

Session 3 --------- Type : Remote Destination Session Source Ports : RX Only : Gi0/6 Destination Ports : Gi0/7

Encapsulation : Native

Ingress : Disabled

Based on this output, which statement is correct?

Trap 1: The session is an ERSPAN destination session because it uses RX…

ERSPAN uses IP encapsulation, not VLAN-based. This is RSPAN.

Trap 2: The session is a local SPAN session with source port Gi0/6.

The type is 'Remote Destination Session', not local.

Trap 3: The session is misconfigured because the destination port has…

Ingress disabled is normal for SPAN destination ports to prevent forwarding.

A
The session is an RSPAN destination session, and traffic from the RSPAN VLAN is received on Gi0/6 and sent to Gi0/7.
The type 'Remote Destination Session' confirms RSPAN destination, with Gi0/6 as source and Gi0/7 as destination.
B
The session is an ERSPAN destination session because it uses RX only.
Why wrong: ERSPAN uses IP encapsulation, not VLAN-based. This is RSPAN.
C
The session is a local SPAN session with source port Gi0/6.
Why wrong: The type is 'Remote Destination Session', not local.
D
The session is misconfigured because the destination port has ingress disabled.
Why wrong: Ingress disabled is normal for SPAN destination ports to prevent forwarding.

Question 13mediummultiple choice

A network engineer runs the following command on router R2:

R2# show monitor session 4

Session 4 --------- Type : ERSPAN Source Session Status : Admin Enabled Source Ports : Both : Gi0/0 Destination IP : 192.168.1.10 Origin IP : 10.0.0.2 ERSPAN ID : 100

Based on this output, which statement is correct?

Trap 1: The ERSPAN session is mirroring traffic from IP 192.168.1.10 to…

The source is Gi0/0, not the IP address.

Trap 2: The ERSPAN session is using RSPAN encapsulation.

ERSPAN uses GRE/IP encapsulation, not VLAN-based RSPAN.

Trap 3: The ERSPAN session is disabled because the status is 'Admin…

'Admin Enabled' means the session is administratively enabled, not disabled.

A
The ERSPAN session is mirroring traffic from Gi0/0 to IP address 192.168.1.10 using ERSPAN ID 100.
The output clearly shows source port Gi0/0, destination IP 192.168.1.10, and ERSPAN ID 100.
B
The ERSPAN session is mirroring traffic from IP 192.168.1.10 to Gi0/0.
Why wrong: The source is Gi0/0, not the IP address.
C
The ERSPAN session is using RSPAN encapsulation.
Why wrong: ERSPAN uses GRE/IP encapsulation, not VLAN-based RSPAN.
D
The ERSPAN session is disabled because the status is 'Admin Enabled'.
Why wrong: 'Admin Enabled' means the session is administratively enabled, not disabled.

Question 14mediummultiple choice

A network engineer runs the following command on router R3:

R3# show monitor session 5

Session 5 --------- Type : ERSPAN Destination Session Status : Admin Enabled Source IP : 10.0.0.2 Destination Ports : Gi0/1

Encapsulation : Native

Ingress : Disabled ERSPAN ID : 100

Based on this output, which statement is correct?

Trap 1: The ERSPAN destination session sends traffic to source IP 10.0.0.2.

The source IP is where traffic comes from, not where it is sent.

Trap 2: The session is an RSPAN destination session because it uses a…

The type is 'ERSPAN Destination Session', not RSPAN.

Trap 3: The session is misconfigured because the destination port has…

Ingress disabled is normal for SPAN destination ports.

A
The ERSPAN destination session receives traffic from source IP 10.0.0.2 and sends it to Gi0/1.
The output shows source IP 10.0.0.2, destination port Gi0/1, and ERSPAN ID 100, confirming this.
B
The ERSPAN destination session sends traffic to source IP 10.0.0.2.
Why wrong: The source IP is where traffic comes from, not where it is sent.
C
The session is an RSPAN destination session because it uses a destination port.
Why wrong: The type is 'ERSPAN Destination Session', not RSPAN.
D
The session is misconfigured because the destination port has ingress disabled.
Why wrong: Ingress disabled is normal for SPAN destination ports.

Question 15hardmultiple choice

A network engineer runs the following command on switch SW4:

SW4# show monitor session 6

Session 6 --------- Type : Local Session Source Ports : Both : Gi0/8, Gi0/9 Destination Ports : Gi0/10

Encapsulation : Native

Ingress : Enabled

Based on this output, which statement is correct?

Trap 1: The SPAN session is misconfigured because source ports cannot be…

Both directions are valid for SPAN source ports.

Trap 2: The SPAN session is using RSPAN because the destination port has…

RSPAN uses a VLAN as destination, not a port. Ingress enabled is unrelated to RSPAN.

Trap 3: The SPAN session is disabled because the destination port has…

The session is still active; ingress enabled does not disable the session.

A
The SPAN session is configured correctly and will forward traffic received on Gi0/10 into the network.
Ingress enabled on the destination port allows traffic received on that port to be forwarded, which is atypical and can cause issues.
B
The SPAN session is misconfigured because source ports cannot be monitored in both directions.
Why wrong: Both directions are valid for SPAN source ports.
C
The SPAN session is using RSPAN because the destination port has ingress enabled.
Why wrong: RSPAN uses a VLAN as destination, not a port. Ingress enabled is unrelated to RSPAN.
D
The SPAN session is disabled because the destination port has ingress enabled.
Why wrong: The session is still active; ingress enabled does not disable the session.

Question 16mediummultiple choice

A network engineer runs the following command on switch SW5:

SW5# show monitor session 7

Session 7 --------- Type : Local Session Source Ports : Both : Gi0/11 Destination Ports : Gi0/12

Encapsulation : Replicate

Ingress : Disabled

Based on this output, which statement is correct?

Trap 1: The SPAN session will strip the VLAN tag from the mirrored traffic.

'Replicate' preserves the tag; 'Native' strips it.

Trap 2: The SPAN session is using RSPAN because the encapsulation is set to…

RSPAN uses a VLAN as destination, not encapsulation type.

Trap 3: The SPAN session is misconfigured because encapsulation Replicate…

Encapsulation Replicate is a valid option on many switches.

A
The SPAN session will replicate the original VLAN tag on the mirrored traffic sent to Gi0/12.
The encapsulation type 'Replicate' indicates that the original VLAN tag is preserved.
B
The SPAN session will strip the VLAN tag from the mirrored traffic.
Why wrong: 'Replicate' preserves the tag; 'Native' strips it.
C
The SPAN session is using RSPAN because the encapsulation is set to Replicate.
Why wrong: RSPAN uses a VLAN as destination, not encapsulation type.
D
The SPAN session is misconfigured because encapsulation Replicate is not supported.
Why wrong: Encapsulation Replicate is a valid option on many switches.

Question 17hardmultiple choice

A network engineer runs the following command on switch SW6:

SW6# show monitor session 8

Session 8 --------- Type : Remote Source Session Source Ports : Both : Gi0/13 Source VLANs : TX Only : 200 Destination Ports : Gi0/14

Encapsulation : Dot1q

Ingress : Disabled

Based on this output, which statement is correct?

Trap 1: The RSPAN source session sends mirrored traffic to Gi0/14 without…

Dot1q encapsulation adds a VLAN tag.

Trap 2: The session is an ERSPAN source session because it uses Dot1q…

ERSPAN uses IP encapsulation, not Dot1q.

Trap 3: The session is misconfigured because source VLANs cannot be TX only.

TX only is a valid filter for source VLANs in RSPAN.

A
The RSPAN source session sends mirrored traffic to Gi0/14 with a Dot1q tag.
The encapsulation type 'Dot1q' means the traffic is tagged with the RSPAN VLAN.
B
The RSPAN source session sends mirrored traffic to Gi0/14 without any VLAN tag.
Why wrong: Dot1q encapsulation adds a VLAN tag.
C
The session is an ERSPAN source session because it uses Dot1q encapsulation.
Why wrong: ERSPAN uses IP encapsulation, not Dot1q.
D
The session is misconfigured because source VLANs cannot be TX only.
Why wrong: TX only is a valid filter for source VLANs in RSPAN.

Question 18mediummultiple choice

A network engineer runs the following command on router R4:

R4# show monitor session 9

Session 9 --------- Type : ERSPAN Source Session Status : Admin Disabled Source Ports : Both : Gi0/2 Destination IP : 192.168.2.20 Origin IP : 10.0.0.3 ERSPAN ID : 200

Based on this output, which statement is correct?

Trap 1: The ERSPAN session is actively mirroring traffic from Gi0/2 to…

The status is 'Admin Disabled', so it is not active.

Trap 2: The ERSPAN session is using RSPAN because the status is disabled.

The type is ERSPAN, and status disabled is unrelated to RSPAN.

Trap 3: The ERSPAN session is misconfigured because the origin IP is…

The origin IP is present (10.0.0.3).

A
The ERSPAN session is configured but not currently active because it is administratively disabled.
The status 'Admin Disabled' indicates the session is not active.
B
The ERSPAN session is actively mirroring traffic from Gi0/2 to 192.168.2.20.
Why wrong: The status is 'Admin Disabled', so it is not active.
C
The ERSPAN session is using RSPAN because the status is disabled.
Why wrong: The type is ERSPAN, and status disabled is unrelated to RSPAN.
D
The ERSPAN session is misconfigured because the origin IP is missing.
Why wrong: The origin IP is present (10.0.0.3).

Question 19mediummultiple choice

Consider the following partial configuration on a Cisco IOS-XE switch:

monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination interface GigabitEthernet1/0/2

What is the effect of this configuration?

Trap 1: It copies only ingress traffic from GigabitEthernet1/0/1 to…

The 'both' keyword includes egress as well.

Trap 2: It copies only egress traffic from GigabitEthernet1/0/1 to…

The 'both' keyword includes ingress as well.

Trap 3: It copies traffic from GigabitEthernet1/0/2 to GigabitEthernet1/0/1.

Source and destination are clearly defined; direction is from source to destination.

A
It copies all traffic received and transmitted on GigabitEthernet1/0/1 to GigabitEthernet1/0/2.
The 'both' keyword specifies both ingress and egress traffic.
B
It copies only ingress traffic from GigabitEthernet1/0/1 to GigabitEthernet1/0/2.
Why wrong: The 'both' keyword includes egress as well.
C
It copies only egress traffic from GigabitEthernet1/0/1 to GigabitEthernet1/0/2.
Why wrong: The 'both' keyword includes ingress as well.
D
It copies traffic from GigabitEthernet1/0/2 to GigabitEthernet1/0/1.
Why wrong: Source and destination are clearly defined; direction is from source to destination.

Question 20mediummultiple choice

Given the configuration:

monitor session 2 source vlan 10-12 both monitor session 2 destination interface GigabitEthernet1/0/3

Which statement is true?

Trap 1: Only traffic from the access ports in VLAN 10 is copied.

The range includes VLANs 10, 11, and 12.

Trap 2: The destination port must be in VLAN 10.

The destination port is not required to be in the source VLAN.

Trap 3: The destination port will become a SPAN destination and cannot be…

While true, this is not the primary effect; the statement is correct but not the best answer.

A
Traffic from all ports in VLANs 10, 11, and 12 is copied to GigabitEthernet1/0/3.
VLAN SPAN monitors all ports in the specified VLANs.
B
Only traffic from the access ports in VLAN 10 is copied.
Why wrong: The range includes VLANs 10, 11, and 12.
C
The destination port must be in VLAN 10.
Why wrong: The destination port is not required to be in the source VLAN.
D
The destination port will become a SPAN destination and cannot be used for normal traffic.
Why wrong: While true, this is not the primary effect; the statement is correct but not the best answer.