CCNP Switch FAQ: Using Port Mirroring to Monitor Traffic
Q1. Which of the following allows traffic on one port to be mirrored to another port on the same switch?
a. VSPAN
b. RSPAN
c. Local SPAN
d. CSPAN
Q2. A local SPAN session can use which of the following as a source? (Choose all that apply.)
a. Physical interface
b. VLAN
c. SVI
d. An interface in an EtherChannel
e. A port-channel interface
Q3. Which one of the following answers contains the command(s) to correctly configure a local SPAN session to mirror all traffic from interface Gi1/0/13 to interface Gi1/0/27?
a. monitor session 1 interface gi1/0/13 interface gi1/0/27
b. monitor interface gi1/0/13 interface gi1/0/27
c. monitor session 1 source interface gi1/0/13 both
monitor session 1 destination interface gi1/0/27
d. monitor session 1 source interface gi1/0/27 both
monitor session 1 destination interface gi1/0/13
Q4. Which one of the following must be configured to connect switches used for RSPAN?
a. An 802.1Q trunk allowing data VLANs
b. Access mode switch ports (single VLAN)
c. A private VLAN over a trunk
d. An RSPAN VLAN over a trunk
Q5. Which one of the following correctly describes a difference between an RSPAN VLAN and a regular VLAN?
a. The RSPAN VLAN disables MAC address learning.
b. The RSPAN VLAN uses static MAC address definitions.
c. The RSPAN VLAN has the RSPAN source and destination MAC addresses
defined in the CAM table.
d. The RSPAN VLAN cannot be carried over a trunk link.
Q6. To configure an RSPAN session’s source switch, what is used for the session destination?
a. The switch port leading to the destination switch
b. The RSPAN VLAN
c. The final destination switch port
d. The next-hop router
Q7. Which two of the following will correctly display active SPAN sessions on a switch?
a. show span
b. show monitor
c. show running-config
d. show session
Q8. Suppose a switch has the following SPAN configuration:
monitor session 1 source interface gi1/0/1 both
monitor session 1 destination interface gi1/0/48
monitor session 2 source interface gi1/0/1 both
monitor session 2 destination remote vlan 99
Which of the following commands will correctly delete only the local SPAN session?
(Choose all that apply.)
a. no monitor session all
b. no monitor session 1
c. no monitor session 2
d. no monitor session local
e. no monitor session remot
More Resources