hardMultiple ChoiceObjective-mapped
Understanding Local SPAN with Ingress Enabled on Destination Port
A network engineer runs the following command on Switch SW7:
SW7# show monitor session 7
Session 7 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Destination Ports : Gi1/0/20
Encapsulation : Native
Ingress : Enabled
Based on this output, what can be concluded?
Quick Answer
The answer is that the destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic. This is because the output shows a local SPAN session with ingress enabled on the destination port, which is an unusual configuration. Normally, when you configure a SPAN destination port, ingress is disabled by default to prevent Layer 2 loops and to keep the port dedicated solely to receiving mirrored packets. By explicitly enabling ingress, the switch allows the destination port to both forward normal traffic arriving on it and continue to send the copied SPAN traffic out of it, which can be useful for inline monitoring tools or intrusion detection systems. On the ENCOR 350-401 exam, this scenario tests your understanding of SPAN behavior beyond the default settings, and a common trap is assuming that a destination port always drops incoming frames. A helpful memory tip is: "Ingress enabled on a SPAN destination means the port can both send mirrors and receive normal frames."
⚠ Common exam trap
Cisco often tests the misconception that a SPAN destination port always drops all incoming traffic, but the 'Ingress : Enabled' setting explicitly overrides that default behavior, making it a common trap for candidates who overlook the ingress field in the output.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.
The output shows a local SPAN session with the destination port Gi1/0/20 configured with 'Ingress : Enabled'. This means the destination port can forward incoming traffic (traffic received on Gi1/0/20) in addition to sending mirrored traffic from the source port Gi1/0/1. By default, a SPAN destination port drops all incoming traffic, but enabling ingress allows it to process and forward incoming frames.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.
Why this is correct
Ingress enabled allows the port to forward received traffic.
- ✗
This is an RSPAN session with a remote VLAN.
Why it's wrong here
The type is Local, not Remote.
- ✗
Only egress traffic from Gi1/0/1 is mirrored.
Why it's wrong here
Both directions are captured.
- ✗
The destination port is configured to block all incoming traffic.
Why it's wrong here
Ingress is enabled, so traffic is not blocked.
Go deeper
Related to this question
Learn chapter
Network Architecture Fundamentals
Key term
SPAN and RSPAN
SPAN and RSPAN are Cisco features that copy network traffic from one or more ports to another port for analysis, with RSPAN extending this capability across multiple switches.
Key term
Network Visibility
Network visibility is the ability to see, monitor, and understand all traffic and devices on a network to ensure security, performance, and troubleshooting.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer runs the following command on Switch SW4: SW4# show monitor session 4 Session 4 --------- Type : Local Session Source VLANs : RX Only : 10,20 Destination Ports : Gi1/0/25 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?
medium- ✓ A.Only incoming traffic on VLANs 10 and 20 is mirrored to Gi1/0/25.
- B.Both incoming and outgoing traffic on VLANs 10 and 20 are mirrored.
- C.This is an RSPAN session using VLANs 10 and 20 as remote VLANs.
- D.The destination port Gi1/0/25 is configured to receive mirrored traffic.
Why A: The output shows a local SPAN session with source VLANs 10 and 20 configured for RX Only, meaning only incoming traffic on those VLANs is mirrored to the destination port Gi1/0/25. The 'Ingress: Disabled' confirms that the destination port does not inject any traffic back into the switch, and 'Encapsulation: Native' indicates the mirrored frames are sent without an additional VLAN tag. Therefore, option A is correct because the session explicitly mirrors only received (incoming) traffic from VLANs 10 and 20.
Variation 2. A network engineer runs the following command on Switch SW1: SW1# show monitor session 1 Session 1 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Both : Gi1/0/2 Destination Ports : Gi1/0/10 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?
medium- ✓ A.Traffic from Gi1/0/1 and Gi1/0/2 is copied to Gi1/0/10 for monitoring.
- B.This is an RSPAN session that sends traffic to a remote VLAN.
- C.Ingress traffic on Gi1/0/10 is forwarded to the source ports.
- D.The destination port is configured to capture only egress traffic.
Why A: The output shows a local SPAN session where source ports Gi1/0/1 and Gi1/0/2 are configured to capture both ingress and egress traffic, and the destination port is Gi1/0/10. This means all traffic entering or leaving the source ports is copied to Gi1/0/10 for monitoring. The 'Both' keyword under source ports confirms bidirectional traffic capture, and the destination port is not involved in any forwarding back to the sources.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.