Question 1,057 of 1,420
mediumMultiple ChoiceObjective-mapped
Interpreting RSPAN Destination Session from show monitor session Output
A network engineer runs the following command on Switch SW6:
SW6# show monitor session 6
Session 6 --------- Type : Remote Destination Session Source RSPAN VLAN : 200 Destination Ports : Gi1/0/12
Encapsulation : Native
Ingress : Disabled
Based on this output, what can be concluded?
Quick Answer
The answer is that this switch receives mirrored traffic from RSPAN VLAN 200 and sends it to Gi1/0/12. This is correct because the output explicitly identifies the session as a Remote Destination Session, with the source listed as RSPAN VLAN 200 and the destination port as Gi1/0/12. In an RSPAN configuration, the destination switch does not generate its own mirrored traffic; instead, it receives the mirrored frames over the specified RSPAN VLAN and forwards them out the designated destination port for analysis by a monitoring device. On the ENCOR 350-401 exam, this question tests your ability to interpret the show monitor session output and distinguish between source and destination RSPAN sessions—a common trap is confusing the RSPAN VLAN as a source of traffic rather than as the transport medium. Remember that the destination port’s Native encapsulation and disabled ingress confirm it only egresses traffic from the RSPAN VLAN. Memory tip: “Destination switch, destination port—it receives, not sends, the source report.”
⚠ Common exam trap
Cisco often tests the distinction between RSPAN source and destination roles; the trap here is confusing 'Source RSPAN VLAN' as the source of the mirrored traffic (it is the transport VLAN) versus the source switch, leading candidates to incorrectly think the switch is sending traffic to a remote switch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
This switch receives mirrored traffic from RSPAN VLAN 200 and sends it to Gi1/0/12.
The output shows a Remote Destination Session, meaning this switch (SW6) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 200 and forwards it out of the destination port Gi1/0/12. The 'Source RSPAN VLAN: 200' indicates the VLAN carrying the mirrored traffic from the source switch, and 'Destination Ports: Gi1/0/12' confirms the local egress interface for the mirrored packets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
This switch receives mirrored traffic from RSPAN VLAN 200 and sends it to Gi1/0/12.
Why this is correct
The type 'Remote Destination Session' and source RSPAN VLAN confirm this.
- ✗
This is a local SPAN session with source VLAN 200.
Why it's wrong here
The type is Remote Destination, not Local.
- ✗
The RSPAN VLAN 200 is used to send traffic to a remote switch.
Why it's wrong here
This switch is the destination, so it receives from the VLAN.
- ✗
Ingress traffic on Gi1/0/12 is forwarded to the RSPAN VLAN.
Why it's wrong here
Ingress is disabled.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer runs the following command on Switch SW3: SW3# show monitor session 3 Session 3 --------- Type : Remote Destination Session Source RSPAN VLAN : 100 Destination Ports : Gi1/0/15 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?
hard- ✓ A.This switch receives mirrored traffic from the RSPAN VLAN and sends it to Gi1/0/15.
- B.This is a local SPAN session with source VLAN 100.
- C.The RSPAN VLAN 100 is used to send traffic to a remote switch.
- D.Ingress traffic on Gi1/0/15 is forwarded to the RSPAN VLAN.
Why A: The output shows a Remote Destination Session, meaning this switch (SW3) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 100 and forwards it out of the destination port Gi1/0/15, typically to a monitoring device. The 'Ingress: Disabled' confirms that traffic entering Gi1/0/15 is not being injected back into the switch.
Variation 2. A network engineer runs the following command on Switch SW9: SW9# show monitor session 9 Session 9 --------- Type : Remote Destination Session Source RSPAN VLAN : 300 Destination Ports : Gi1/0/40 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?
hard- ✓ A.This switch receives mirrored traffic from RSPAN VLAN 300 and sends it to Gi1/0/40.
- B.This is a local SPAN session with source VLAN 300.
- C.The RSPAN VLAN 300 is used to send traffic to a remote switch.
- D.Ingress traffic on Gi1/0/40 is forwarded to the RSPAN VLAN.
Why A: The output shows a Remote Destination Session, meaning this switch (SW9) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 300 and forwards it out of the destination port Gi1/0/40. The 'Source RSPAN VLAN: 300' indicates the VLAN carrying the mirrored traffic from the remote source switch, and 'Destination Ports: Gi1/0/40' confirms the local egress port.
Last reviewed: Jul 4, 2026
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.