Question 722 of 1,958
mediumMultiple ChoiceObjective-mapped
Interpreting RSPAN Source Session from show monitor session Output
A network engineer runs the following command on Switch SW2:
SW2# show monitor session 2
Session 2 --------- Type : Remote Source Session Source Ports : TX Only : Gi1/0/5 RX Only : Gi1/0/6 Destination Ports : Gi1/0/20
Encapsulation : Replicate
Based on this output, what can be concluded?
Quick Answer
The answer is that this output indicates an RSPAN source session, where the switch is configured to send mirrored traffic to a remote VLAN rather than to a local destination port. This is correct because the session type is explicitly labeled "Remote Source Session," and the destination port uses "Replicate" encapsulation, which is the standard method for forwarding mirrored frames onto an RSPAN VLAN for transport to a remote destination switch. On the ENCOR 350-401 exam, this question tests your ability to differentiate between local SPAN, RSPAN, and ERSPAN by reading the "show monitor session" output—a common trap is confusing "Replicate" with ERSPAN's "GRE" encapsulation or assuming a destination port means local SPAN. Remember that RSPAN always involves a source switch sending traffic to a remote VLAN, while the destination switch uses a reflector port. Memory tip: "RSPAN Replicates to a Remote VLAN."
⚠ Common exam trap
Cisco often tests the distinction between source and destination sessions in RSPAN, where candidates mistakenly think a destination port on a source switch receives traffic, when in fact it sends mirrored traffic onto the RSPAN VLAN.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
This is an RSPAN source session, sending mirrored traffic to a remote VLAN.
The output shows 'Type: Remote Source Session', which indicates this is an RSPAN source session. The source ports Gi1/0/5 and Gi1/0/6 are configured to send mirrored traffic (TX only and RX only, respectively) to a destination port Gi1/0/20 with encapsulation set to 'Replicate', meaning the traffic is replicated onto an RSPAN VLAN for transport to a remote switch. This matches the definition of an RSPAN source session, where mirrored traffic is sent to a remote VLAN rather than a local destination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
This is an RSPAN source session, sending mirrored traffic to a remote VLAN.
Why this is correct
The output shows a Remote Source Session with source ports assigned separately for TX Only (Gi1/0/5) and RX Only (Gi1/0/6), which is a characteristic of RSPAN source configuration. The destination port Gi1/0/20 uses Encapsulation: Replicate, indicating traffic is forwarded onto a remote VLAN rather than a local analyser, satisfying the RSPAN definition of sending mirrored traffic to a remote VLAN for collection elsewhere.
- ✗
This is a local SPAN session with bidirectional capture.
Why it's wrong here
The type is Remote Source, not Local, and capture is unidirectional per port.
- ✗
The destination port Gi1/0/20 is used to receive mirrored traffic from another switch.
Why it's wrong here
The destination port Gi1/0/20 is configured with encapsulation set to Replicate, which indicates it transmits an exact copy of the source traffic out of the switch; in a Remote Source Session, the destination port forwards mirrored traffic to a remote analyser, not receives it from another switch. This option is tempting because in a local SPAN session a destination port does receive traffic for monitoring, but here the session type is explicitly Remote Source, where the destination port acts as an egress for replicated frames to a remote collector.
- ✗
Both source ports capture all traffic in both directions.
Why it's wrong here
Gi1/0/5 captures TX only, Gi1/0/6 captures RX only.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer runs the following command on Switch SW8: SW8# show monitor session 8 Session 8 --------- Type : Remote Source Session Source VLANs : Both : 30 Destination Ports : Gi1/0/30 Encapsulation : Replicate Based on this output, what can be concluded?
medium- ✓ A.All traffic on VLAN 30 is mirrored and sent to a remote VLAN via Gi1/0/30.
- B.This is a local SPAN session that monitors VLAN 30.
- C.Only received traffic on VLAN 30 is captured.
- D.The destination port Gi1/0/30 is used to receive mirrored traffic.
Why A: The output shows a Remote Source SPAN (RSPAN) session, where traffic on VLAN 30 (both sent and received) is replicated and sent out destination port Gi1/0/30. The 'Encapsulation: Replicate' indicates that the mirrored frames are forwarded unchanged to the destination port, which is typically connected to an RSPAN VLAN for transport to a remote monitoring device. Therefore, all traffic on VLAN 30 is mirrored and sent via Gi1/0/30 to a remote VLAN.
Last reviewed: Jul 4, 2026
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.