mediumMultiple Choice
350-401 Practice Question: Runs the following command on Switch SW1: SW1#…
A network engineer runs the following command on Switch SW1:
SW1# show monitor session 1
Session 1 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Both : Gi1/0/2 Destination Ports : Gi1/0/10
Encapsulation : Native
Ingress : Disabled
Based on this output, what can be concluded?
⚠ Common exam trap
Cisco often tests the distinction between 'Both' (capturing ingress and egress) and the 'Ingress' field under the destination port (which controls whether incoming traffic on the destination port is forwarded), leading candidates to confuse capture direction with destination port behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic from Gi1/0/1 and Gi1/0/2 is copied to Gi1/0/10 for monitoring.
The output shows a local SPAN session where source ports Gi1/0/1 and Gi1/0/2 are configured to capture both ingress and egress traffic, and the destination port is Gi1/0/10. This means all traffic entering or leaving the source ports is copied to Gi1/0/10 for monitoring. The 'Both' keyword under source ports confirms bidirectional traffic capture, and the destination port is not involved in any forwarding back to the sources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Traffic from Gi1/0/1 and Gi1/0/2 is copied to Gi1/0/10 for monitoring.
Why this is correct
This is a Local SPAN session. The source ports Gi1/0/1 and Gi1/0/2 each capture both ingress and egress traffic, and the switch copies those frames to the destination port Gi1/0/10, which resides on the same switch. The monitoring device connected to Gi1/0/10 receives a real-time copy of all traffic seen on the source ports, without any impact to the original traffic flow.
- ✗
This is an RSPAN session that sends traffic to a remote VLAN.
Why it's wrong here
This cannot be RSPAN because the destination is a physical port (Gi1/0/10), not a remote VLAN. RSPAN requires configuring a dedicated VLAN as the destination, which then carries the mirrored traffic to a remote switch where an analyzer port is placed. In contrast, the session shown here uses a local destination port directly on the same switch, which is the defining characteristic of Local SPAN.
- ✗
Ingress traffic on Gi1/0/10 is forwarded to the source ports.
Why it's wrong here
Ingress on the destination port Gi1/0/10 is disabled by default, so any frames that happen to arrive on that interface are silently dropped and are never forwarded to the source ports. SPAN directionality is strictly one-way: traffic flows from the source ports to the destination port, not back. Thus the statement incorrectly suggests a reverse forwarding path that is not supported in a standard SPAN configuration.
- ✗
The destination port is configured to capture only egress traffic.
Why it's wrong here
The destination port Gi1/0/10 does not 'capture' traffic at all; it is the source ports that copy their ingress and egress frames to the destination. The direction-based filtering (ingress/egress) is a property of the source ports, and in this session both directions are copied. The destination port simply transmits the replicated frames out to the monitoring device, and its own ingress is disabled, so it cannot be said to capture only egress traffic.
Go deeper
Related to this question
Learn chapter
Network Monitoring and Troubleshooting Tools
Key term
Network Visibility
Network visibility is the ability to see, monitor, and understand all traffic and devices on a network to ensure security, performance, and troubleshooting.
Key term
SPAN and RSPAN
SPAN and RSPAN are Cisco features that copy network traffic from one or more ports to another port for analysis, with RSPAN extending this capability across multiple switches.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.