mediumMultiple Choice
350-401 Practice Question: Given the following configuration on a Cisco…
Given the following configuration on a Cisco switch:
monitor session 1 source interface GigabitEthernet1/0/1 - 3 both monitor session 1 destination interface GigabitEthernet1/0/4
What is the effect of this configuration?
⚠ Common exam trap
Cisco often tests the hyphen range syntax in SPAN source interfaces, where candidates mistakenly think only the first interface is selected or that the syntax is invalid, rather than recognizing it as a valid range operator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic from GigabitEthernet1/0/1, 1/0/2, and 1/0/3 is copied to GigabitEthernet1/0/4.
The configuration uses a local SPAN session to mirror traffic from a range of source interfaces (GigabitEthernet1/0/1 through 1/0/3) to a single destination interface (GigabitEthernet1/0/4). The keyword 'both' indicates that both ingress and egress traffic from the source interfaces are copied. This allows network administrators to monitor all traffic on those ports without disrupting the production flow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Traffic from GigabitEthernet1/0/1, 1/0/2, and 1/0/3 is copied to GigabitEthernet1/0/4.
Why this is correct
The range keyword in the SPAN session configuration designates GigabitEthernet1/0/1, 1/0/2, and 1/0/3 as multiple source interfaces, all feeding copied traffic to a single destination port, GigabitEthernet1/0/4. Local SPAN explicitly allows multiple source interfaces in one session, and the monitoring port receives a replica of each source's traffic without altering the original forwarding path, making this the correct behavior.
- ✗
Only traffic from GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/4.
Why it's wrong here
The range syntax is an inclusive list, so GigabitEthernet1/0/1, 1/0/2, and 1/0/3 are all treated as separate SPAN source ports. SPAN does not stop at the first interface; every interface specified in the range is actively monitored, and the destination port receives copies from all three, not just the first one.
- ✗
Traffic from GigabitEthernet1/0/4 is copied to GigabitEthernet1/0/1, 1/0/2, and 1/0/3.
Why it's wrong here
SPAN functions in one direction only: it copies traffic from the source ports to the destination port, never from the destination back to the sources. Moreover, the destination port is typically excluded from the source list and serves solely as the analyzer connection point, so any configuration implying reverse or bidirectional replication is fundamentally incorrect.
- ✗
The configuration is invalid because a SPAN session can only have one source interface.
Why it's wrong here
This configuration is perfectly valid because Cisco's local SPAN supports multiple source interfaces within a single session; you are not restricted to one source port. The only platform-specific limitation is that mixing source interfaces and source VLANs in the same session may be disallowed on some hardware, but a range of physical interfaces is a standard and legal way to aggregate monitoring targets.
Go deeper
Related to this question
Learn chapter
EIGRP: Basics and Advanced Configuration
Key term
SPAN and RSPAN
SPAN and RSPAN are Cisco features that copy network traffic from one or more ports to another port for analysis, with RSPAN extending this capability across multiple switches.
Key term
Network Visibility
Network visibility is the ability to see, monitor, and understand all traffic and devices on a network to ensure security, performance, and troubleshooting.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.