Courseiva
← 350-401
Full test
mediumMultiple Choice

SPAN Direction: rx, tx, both

Given the following configuration snippet on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast

monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination interface GigabitEthernet1/0/2

What is the effect of this configuration?

Quick Answer

The correct answer is that all traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2. This is because the monitor session configuration explicitly specifies the `both` keyword for the source interface, which directs the SPAN session to replicate both ingress (rx) and egress (tx) traffic. Without the `both` keyword, the default behavior on Cisco IOS-XE switches is to copy only rx traffic, so specifying `both` ensures full-duplex traffic capture. On the ENCOR 350-401 exam, this tests your understanding of SPAN direction options—rx, tx, and both—and how they affect traffic monitoring. A common trap is assuming that omitting the direction keyword defaults to `both`, but it actually defaults to `rx` only. Remember the mnemonic: "Both is best for full capture, rx is the default rapture."

⚠ Common exam trap

Candidates often confuse 'both' with 'rx' or 'tx' and assume only one direction is mirrored, or they mistakenly think the destination port must be in trunk mode to carry VLAN tags, but in local SPAN the destination port can be an access port and the mirrored frames are sent untagged by default.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

All traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.

The configuration uses a local SPAN session to copy traffic from a source interface (GigabitEthernet1/0/1) to a destination interface (GigabitEthernet1/0/2). The keyword 'both' specifies that both ingress and egress traffic on the source port are mirrored, so all traffic entering and leaving GigabitEthernet1/0/1 is sent to the destination port for monitoring.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    All traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.

    Why this is correct

    The monitor session statement names GigabitEthernet1/0/1 as source with the 'both' keyword, so ingress and egress frames on that port are replicated to the destination port GigabitEthernet1/0/2. SPAN copies traffic; it does not alter forwarding on the access port.

  • ✗

    Only traffic entering GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.

    Why it's wrong here

    The 'both' keyword captures ingress and egress frames on the source interface, so traffic in both directions is copied. It is tempting because 'source' can be read as inbound only, but the explicit 'both' parameter overrides that default, and 'rx' alone would be correct if only entering traffic were mirrored.

  • ✗

    Traffic on GigabitEthernet1/0/2 is replicated to GigabitEthernet1/0/1.

    Why it's wrong here

    The monitor session statement designates GigabitEthernet1/0/1 as source and GigabitEthernet1/0/2 as destination, so traffic flows the opposite way. It is tempting because SPAN does copy traffic between two ports, but the direction is fixed by the source/destination keywords, and reversing them would be correct only if the roles were swapped.

  • ✗

    The configuration is invalid because the destination port must be in trunk mode.

    Why it's wrong here

    A SPAN destination port accepts access mode; it need not be a trunk, and IOS-XE permits this configuration. It is tempting because destination ports do carry copied frames from multiple VLANs, but that is achieved by the SPAN feature itself, and trunk mode would be required only for carrying tagged traffic between switches.

Visual reference

SW1 Root Bridge SW2 SW3 BLK DP DP RP RP STP blocks one link to prevent loops DP = Designated Port RP = Root Port BLK = Blocked

About these practice questions

This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on 350-401

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Consider the following SPAN configuration on a Cisco IOS-XE switch: monitor session 2 source interface GigabitEthernet1/0/3 rx monitor session 2 destination interface GigabitEthernet1/0/4 What is the effect of this configuration?

medium
  • ✓ A.Only traffic received on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.
  • B.Both ingress and egress traffic on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.
  • C.Traffic on GigabitEthernet1/0/4 is mirrored to GigabitEthernet1/0/3.
  • D.The configuration is invalid because the destination interface must be in trunk mode.

Why A: The configuration explicitly specifies the `rx` keyword for the source interface, which limits SPAN to copying only received (ingress) traffic on GigabitEthernet1/0/3 to the destination interface GigabitEthernet1/0/4. Without the `rx` or `tx` keyword, the default behavior would copy both directions, but here the explicit `rx` overrides that default.

Variation 2. Given the following SPAN configuration on a Cisco IOS-XE switch: monitor session 4 source interface GigabitEthernet1/0/6 tx monitor session 4 destination interface GigabitEthernet1/0/7 What does this configuration do?

medium
  • ✓ A.Only traffic transmitted from GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.
  • B.Both ingress and egress traffic on GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.
  • C.Traffic on GigabitEthernet1/0/7 is mirrored to GigabitEthernet1/0/6.
  • D.The configuration is invalid because the destination interface must be in the same VLAN as the source.

Why A: The configuration uses the 'tx' keyword to specify that only traffic transmitted (egress) from GigabitEthernet1/0/6 should be copied to the destination interface GigabitEthernet1/0/7. Without the 'tx' keyword, the default behavior would be to monitor both ingress and egress traffic, but the explicit 'tx' limits the SPAN session to egress traffic only.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.