mediumMultiple Choice
350-401 Which statement about RSPAN is true? Practice Question
Which statement about RSPAN is true?
⚠ Common exam trap
Cisco often tests the distinction between RSPAN and ERSPAN, where candidates mistakenly think RSPAN uses encapsulation (like ERSPAN) or that destination ports must be trunks, when in fact RSPAN relies on a dedicated VLAN and access ports at the destination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RSPAN uses a dedicated VLAN to transport mirrored traffic from source to destination switches.
RSPAN (Remote SPAN) uses a dedicated RSPAN VLAN to carry mirrored traffic from the source switch to one or more destination switches across a network. This allows monitoring of traffic on remote switches, unlike local SPAN which is confined to a single switch. The RSPAN VLAN must be configured on all intermediate switches and trunked appropriately to ensure the mirrored traffic reaches the destination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
RSPAN uses a dedicated VLAN to transport mirrored traffic from source to destination switches.
Why this is correct
RSPAN (Remote Switched Port Analyzer) is designed to forward mirrored traffic from a source switch across a network to a destination switch where an analyzer is attached. To achieve this, it defines a dedicated RSPAN VLAN that serves as a transport backbone: the source SPAN session copies frames into the RSPAN VLAN, and the destination SPAN session extracts those frames to a local monitor port. This VLAN must be allowed on all trunk links between the source and destination switches and should be used exclusively for mirrored traffic to prevent interference with production data.
- ✗
RSPAN can only monitor traffic within the same switch.
Why it's wrong here
This statement incorrectly describes local SPAN, not RSPAN. A local SPAN session copies traffic only on the same switch and sends it to a local destination port, whereas RSPAN's entire purpose is to enable remote monitoring by carrying mirrored traffic over a Layer 2 switched network. With RSPAN, the source and destination switches are different devices, connected via trunk links that transport the dedicated RSPAN VLAN. Thus, limiting RSPAN to a single switch contradicts its fundamental architecture.
- ✗
RSPAN requires the use of ERSPAN encapsulation.
Why it's wrong here
This is a false association. RSPAN operates at Layer 2 and relies on a standard VLAN to transport mirrored Ethernet frames between switches, with no IP or GRE encapsulation involved. ERSPAN (Encapsulated Remote Switched Port Analyzer) is a distinct technology that encapsulates mirrored packets in GRE and routes them over IP networks, often across Layer 3 boundaries. RSPAN and ERSPAN are separate solutions; choosing RSPAN does not require or imply ERSPAN encapsulation.
- ✗
RSPAN destination ports must be in trunk mode.
Why it's wrong here
This is incorrect because RSPAN destination ports are normally configured as access ports placed in the RSPAN VLAN, not trunk ports. The trunk mode requirement applies to the inter-switch links that carry the RSPAN VLAN from the source switch to the destination switch. The final destination port, where the monitoring device is connected, must be an access port in the RSPAN VLAN so that only the extracted mirrored frames are delivered to the analyzer. Configuring a trunk on the destination port would introduce extra VLAN tagging and could confuse the monitoring tool.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Monitoring and Troubleshooting Tools
Key term
SPAN and RSPAN
SPAN and RSPAN are Cisco features that copy network traffic from one or more ports to another port for analysis, with RSPAN extending this capability across multiple switches.
Key term
Network Visibility
Network visibility is the ability to see, monitor, and understand all traffic and devices on a network to ensure security, performance, and troubleshooting.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.