hardMultiple ChoiceObjective-mapped
350-401 Practice Question: Runs the following command on Switch SW5: SW5#…
A network engineer runs the following command on Switch SW5:
SW5# show monitor session 5
Session 5 --------- Type : Remote Source Session Source Ports : Both : Gi1/0/1-3 Destination Ports : Gi1/0/24
Encapsulation : Replicate
Based on this output, what can be concluded?
⚠ Common exam trap
Cisco often tests the distinction between local SPAN and RSPAN by using the 'Type' field in the 'show monitor session' output, and the trap here is that candidates mistake a remote source session for a local SPAN because they focus on the destination port being local, ignoring the 'Remote Source' type indicator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic from ports Gi1/0/1-3 is mirrored and sent to a remote VLAN via Gi1/0/24.
The output shows a Remote Source SPAN (RSPAN) session. The 'Type: Remote Source Session' indicates that traffic from source ports Gi1/0/1-3 is mirrored and sent to a remote VLAN (the RSPAN VLAN) via the destination port Gi1/0/24, which acts as a reflector port. The 'Encapsulation: Replicate' means the destination port replicates the original frames without adding an extra VLAN tag, forwarding them onto the RSPAN VLAN for transport to a remote switch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Traffic from ports Gi1/0/1-3 is mirrored and sent to a remote VLAN via Gi1/0/24.
Why this is correct
The type 'Remote Source Session' and Replicate encapsulation indicate RSPAN source.
- ✗
This is a local SPAN session that sends traffic to Gi1/0/24.
Why it's wrong here
The type is Remote Source, not Local.
- ✗
The destination port Gi1/0/24 is used to receive mirrored traffic from another switch.
Why it's wrong here
In a source session, the destination port sends traffic out.
- ✗
Only egress traffic from Gi1/0/1-3 is captured.
Why it's wrong here
Both directions are captured (Both keyword).
Visual reference
Go deeper
Related to this question
Learn chapter
Network Architecture Fundamentals
Key term
SPAN and RSPAN
SPAN and RSPAN are Cisco features that copy network traffic from one or more ports to another port for analysis, with RSPAN extending this capability across multiple switches.
Key term
Network Visibility
Network visibility is the ability to see, monitor, and understand all traffic and devices on a network to ensure security, performance, and troubleshooting.
About these practice questions
One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.