mediumMultiple Choice
350-401 Practice Question: Consider the following SPAN configuration on a…
Consider the following SPAN configuration on a Cisco IOS-XE switch:
monitor session 2 source interface GigabitEthernet1/0/3 rx monitor session 2 destination interface GigabitEthernet1/0/4
What is the effect of this configuration?
⚠ Common exam trap
Candidates often assume SPAN always copies both ingress and egress traffic by default, but the explicit `rx` keyword changes the behavior to only ingress, and Cisco tests whether you notice that keyword in the configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Only traffic received on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.
The configuration explicitly specifies the `rx` keyword for the source interface, which limits SPAN to copying only received (ingress) traffic on GigabitEthernet1/0/3 to the destination interface GigabitEthernet1/0/4. Without the `rx` or `tx` keyword, the default behavior would copy both directions, but here the explicit `rx` overrides that default.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Only traffic received on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.
Why this is correct
The `rx` keyword restricts the source to ingress traffic only, so frames received on GigabitEthernet1/0/3 are copied to the destination port GigabitEthernet1/0/4. Egress traffic transmitted out of the source interface is not mirrored, satisfying the stem's receive-only monitoring constraint.
- ✗
Both ingress and egress traffic on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.
Why it's wrong here
The rx keyword restricts capture to ingress traffic only, so egress frames on GigabitEthernet1/0/3 are not copied. Omitting rx or using both would capture bidirectional traffic; assuming SPAN mirrors both directions by default is tempting, but the explicit rx keyword narrows the scope.
- ✗
Traffic on GigabitEthernet1/0/4 is mirrored to GigabitEthernet1/0/3.
Why it's wrong here
The source and destination roles are reversed: GigabitEthernet1/0/3 is the source and 1/0/4 the destination, so traffic flows the other way. Reading the destination keyword as the monitored port is tempting, but SPAN copies from source to destination, never in reverse.
- ✗
The configuration is invalid because the destination interface must be in trunk mode.
Why it's wrong here
SPAN destination ports accept copied frames without any trunk encapsulation requirement, so the configuration is valid as written. The claim confuses SPAN with routed or VLAN-tagged links; trunk mode matters only when the destination must carry tagged traffic to an analyser expecting 802.1Q headers.
Go deeper
Related to this question
Learn chapter
EIGRP: Basics and Advanced Configuration
Key term
SPAN and RSPAN
SPAN and RSPAN are Cisco features that copy network traffic from one or more ports to another port for analysis, with RSPAN extending this capability across multiple switches.
Key term
Network Visibility
Network visibility is the ability to see, monitor, and understand all traffic and devices on a network to ensure security, performance, and troubleshooting.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.