CCNP Switch FAQ: Using Port Mirroring to Monitor Traffic

CCNP Switch FAQ: Using Port Mirroring to Monitor Traffic

Q1. Which of the following allows traffic on one port to be mirrored to another port on the same switch?
a. VSPAN
b. RSPAN
c. Local SPAN
d. CSPAN

Answer: C

Q2. A local SPAN session can use which of the following as a source? (Choose all that apply.)
a. Physical interface
b. VLAN
c. SVI
d. An interface in an EtherChannel
e. A port-channel interface

Answer: A, B, D, E

Q3. Which one of the following answers contains the command(s) to correctly configure a local SPAN session to mirror all traffic from interface Gi1/0/13 to interface Gi1/0/27?
a. monitor session 1 interface gi1/0/13 interface gi1/0/27
b. monitor interface gi1/0/13 interface gi1/0/27
c. monitor session 1 source interface gi1/0/13 both
monitor session 1 destination interface gi1/0/27
d. monitor session 1 source interface gi1/0/27 both
monitor session 1 destination interface gi1/0/13

Answer: C
Figure: Using Local SPAN to Monitor Received Traffic

Q4. Which one of the following must be configured to connect switches used for RSPAN?
a. An 802.1Q trunk allowing data VLANs
b. Access mode switch ports (single VLAN)
c. A private VLAN over a trunk
d. An RSPAN VLAN over a trunk

Answer: D

Q5. Which one of the following correctly describes a difference between an RSPAN VLAN and a regular VLAN?
a. The RSPAN VLAN disables MAC address learning.
b. The RSPAN VLAN uses static MAC address definitions.
c. The RSPAN VLAN has the RSPAN source and destination MAC addresses
defined in the CAM table.
d. The RSPAN VLAN cannot be carried over a trunk link.

Answer: A

Q6. To configure an RSPAN session’s source switch, what is used for the session destination?
a. The switch port leading to the destination switch
b. The RSPAN VLAN
c. The final destination switch port
d. The next-hop router

Answer: B

Q7. Which two of the following will correctly display active SPAN sessions on a switch?
a. show span
b. show monitor
c. show running-config
d. show session

Answer: B, C

Q8. Suppose a switch has the following SPAN configuration:
monitor session 1 source interface gi1/0/1 both
monitor session 1 destination interface gi1/0/48
monitor session 2 source interface gi1/0/1 both
monitor session 2 destination remote vlan 99
Which of the following commands will correctly delete only the local SPAN session?
(Choose all that apply.)
a. no monitor session all
b. no monitor session 1
c. no monitor session 2
d. no monitor session local
e. no monitor session remot

Answer: B, D

More Resources

About the author

Prasanna

Leave a Comment