hardMultiple Choice
350-401 Practice Question: Runs the following command on Switch SW3: SW3#…
A network engineer runs the following command on Switch SW3:
SW3# show monitor session 3
Session 3 --------- Type : Remote Destination Session Source RSPAN VLAN : 100 Destination Ports : Gi1/0/15
Encapsulation : Native
Ingress : Disabled
Based on this output, what can be concluded?
⚠ Common exam trap
Cisco often tests the distinction between source and destination RSPAN sessions, and the trap here is confusing the role of the RSPAN VLAN—candidates may think it is used to send traffic away from the switch rather than receive mirrored traffic for local monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
This switch receives mirrored traffic from the RSPAN VLAN and sends it to Gi1/0/15.
The output shows a Remote Destination Session, meaning this switch (SW3) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 100 and forwards it out of the destination port Gi1/0/15, typically to a monitoring device. The 'Ingress: Disabled' confirms that traffic entering Gi1/0/15 is not being injected back into the switch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
This switch receives mirrored traffic from the RSPAN VLAN and sends it to Gi1/0/15.
Why this is correct
A Remote Destination Session is configured on the switch that terminates the RSPAN session. This switch has source RSPAN VLAN 100, meaning it receives mirrored frames from that VLAN and copies them out Gi1/0/15, which is the analyzer port. The destination port is an egress-only monitor port, so the statement accurately describes the data flow.
- ✗
This is a local SPAN session with source VLAN 100.
Why it's wrong here
If the session were local SPAN, the source would be a physical interface or a normal user VLAN on this same switch, and session type would show 'Local'. Instead, the output identifies the session as a 'Remote Destination Session', and the source is the RSPAN VLAN, not VLAN 100 as a mirrored traffic source. A local SPAN cannot use an RSPAN VLAN as its source; RSPAN VLANs are reserved for inter-switch transport.
- ✗
The RSPAN VLAN 100 is used to send traffic to a remote switch.
Why it's wrong here
Although the RSPAN VLAN 100 is used to transport mirrored traffic across the network from the remote source switch to this switch, the direction of traffic on this device is inbound from that VLAN, not outbound. As the destination switch, it does not inject traffic into VLAN 100; it receives the mirrored frames and forwards them only to the local destination port. The statement misstates the switch's role in the RSPAN topology.
- ✗
Ingress traffic on Gi1/0/15 is forwarded to the RSPAN VLAN.
Why it's wrong here
The RSPAN destination port Gi1/0/15 is a monitored analyzer port, not a forwarding port. By default, ingress on an RSPAN destination port is disabled, meaning any traffic arriving on Gi1/0/15 is not switched or forwarded into any VLAN, including VLAN 100. Therefore, no ingress traffic is sent to the RSPAN VLAN; traffic only egresses out of Gi1/0/15 to the monitoring device.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.