SPAN Flashcards

1
Q

How can the traffic that is mirrored out the GigabitEthernet0/48 port be limited to only traffic
that is received or transmitted in VLAN 10 on the GigabitEthernet0/1 port?
A. Change the configuration for GigabitEthernet0/48 so that it is a member of VLAN 10.
B. Add an access list to GigabitEthernet0/48 to filter out traffic that is not in VLAN 10.
C. Apply the monitor session filter globally to allow only traffic from VLAN 10.
D. Change the monitor session source to VLAN 10 instead of the physical interface.

A

C. Apply the monitor session filter globally to allow only traffic from VLAN 10.

–tricky–
Explanation:
We can add the “monitor session 1 filter vlan 10” command to limit monitored traffic from VLAN 10 only.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A network engineer wants to analyze all incoming and outgoing packets for an interface that is connected to an access switch. Which three items must be configured to mirror traffic to a packet sniffer that is connected to the distribution switch? (Choose three)
A. A monitor session on the distribution switch with a physical interface as the source and the remote SPAN VLAN as the destination
B. A remote SPAN VLAN on the distribution and access layer switch
C. A monitor session on the access switch with a physical interface source and the remote SPAN VLAN as the destination
D. A monitor session on the distribution switch with a remote SPAN VLAN as the source and physical interface as the destination
E. A monitor session on the access switch with a remote SPAN VLAN source and the physical interface as the destination
F. A monitor session on the distribution switch with a physical interface as the source and a physical interface as the destination

A

B. A remote SPAN VLAN on the distribution and access layer switch
C. A monitor session on the access switch with a physical interface source and the remote SPAN VLAN as the destination
D. A monitor session on the distribution switch with a remote SPAN VLAN as the source and physical interface as the destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

monitor session 2 filter vlan 1 – 8, 39, 52

What is the result of the implemented command?
A. All VLAN traffic is sent to the SPAN destination interface.
B. Traffic from VLAN 4 is not sent to the SPAN destination interface.
C. Filtering a trunked SPAN port effectively disables SPAN operations for all VLANs.
D. The trunk’s native VLAN must be changed to something other than VLAN 1.
E. Traffic from VLANs 1 to 8, 39, and 52 is replicated to the SPAN destination port.

A

E. Traffic from VLANs 1 to 8, 39, and 52 is replicated to the SPAN destination port.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A network engineer investigates a recent network failure and notices that one of the interfaces
on the switch is still down. What is causing the line protocol on this interface to be shown as
down?

GigabitEthernet0/23 is up, Line Protocol is down (monitoring)

A. There is a layer 1 physical issue.
B. There is a speed mismatch on the interface.
C. The interface is configured as the target of the SPAN session.
D. The interface is configured as the source of the SPAN session.
E. There is a duplex mismatch on the interface.

A

C. The interface is configured as the target of the SPAN session.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

RSPAN has been configured on a Cisco Catalyst switch; however, traffic is not being replicated to the remote switch. Which type of misconfiguration is a cause?
A. The local switch is overloaded with the amount of sourced traffic that must be replicated to the remote switch.
B. The RSPAN designated VLAN is missing the remote span command.
C. The local and remote RSPAN switches are configured using different session IDs.
D. The local RSPAN switch is replicating only Rx traffic to the remote switch.

A

B. The RSPAN designated VLAN is missing the remote span command.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

monitor session 1 source interface g0/4 rx
monitor session 1 filter vlan 3
monitor session 1 destination interface g0/5

A. Configure a SPAN session to monitor the received traffic on interface g0/4 only for VLAN 3
B. Configure a SPAN session to monitor the received traffic on interface g0/5 only for VLAN 3
C. Configure a SPAN session to monitor the received traffic on interface g0/5 for all VLANs except VLAN 3
D. Configure a SPAN session to monitor the received traffic on interface g0/4 for all VLANs except VLAN 3

A

A. Configure a SPAN session to monitor the received traffic on interface g0/4 only for VLAN 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which two statements about SPAN source and destination ports during an active session are true? (Choose two)
A. The source port can be only an Ethernet physical port.
B. The source port can be monitored in multiple SPAN sessions.
C. The destination port can be destination in multiple SPAN sessions.
D. The destination port does not participate in STP.
E. You can mix individual source ports and source VLANs within a single session.

A

B. The source port can be monitored in multiple SPAN sessions.
D. The destination port does not participate in STP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which statement about frame SPAN is true?
A. Destination and source port SPAN works on L2 (Layer 2)
B. Source ports SPAN work on L2 (Layer 2)
C. Destination ports SPAN work on L2 (Layer 2)
D. Destination and source port SPAN don’t work on L2

A

A. Destination and source port SPAN works on L2 (Layer 2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A physical switch port is part of an EtherChannel group. What happens while the same port configured as a SPAN destination?
A. The port forwards traffic in the EtherChannel group and acts as a SPAN source simultaneously.
B. The port is removed from the EtherChannel group.
C. The port is put in the errdisabled state and can only be reenabled manually.
D. The operation is not allowed as an EtherChannel member cannot be a SPAN source port.

A

B. The port is removed from the EtherChannel group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which option is a Cisco recommended RSPAN configuration practice?
A. Use a different RSPAN VLAN for each session if configuring RSPAN on multiple switches.
B. Use only one destination port for each RSPAN session.
C. Define an RSPAN VLAN before configuring an RSPAN source or destination session.
D. Assign access ports to an RSPAN VLAN like any other campus VLAN

A

C. Define an RSPAN VLAN before configuring an RSPAN source or destination session.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which two limitations of LOCAL SPAN are true? (Choose two)
A. The source and destination ports must reside in the same switch or switch stack
B. It can monitor only traffic that ingresses or egresses on the source interface or VLAN
C. A SPAN session can support multiple destination ports only if they are on the same VLAN
D. Each SPAN session supports only one source VLAN or interface
E. A switch can support only one local SPAN session at a time

A

A. The source and destination ports must reside in the same switch or switch stack
B. It can monitor only traffic that ingresses or egresses on the source interface or VLAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which two statements about RSPAN VLAN are true? (Choose two.)
A. RSPAN VLAN must be configured in VLAN configuration mode using the remote-span command.
B. RSPAN VLAN trunks can handle Spanning-Tree protocol, except for SPAN destination ports.
C. RSPAN VLAN access ports can handle Spanning-Tree protocol in conjunction with SPAN destination ports.
D. RSPAN VLAN does not support any protocols.
E. RSPAN VLAN traffic does not get flooded.

A

A. RSPAN VLAN must be configured in VLAN configuration mode using the remote-span command.
B. RSPAN VLAN trunks can handle Spanning-Tree protocol, except for SPAN destination ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which statements about RSPAN are true? (Choose two)
A. It supports MAC address learning.
B. RSPAN VLANs can carry RSPAN traffic only.
C. Only one RSPAN VLAN can be configured per device.
D. RSPAN VLANs are exempt from VTP pruning.
E. MAC address learning is not supported.
F. RSPAN uses are GRE tunnel to transmit captured traffic.

A

B. RSPAN VLANs can carry RSPAN traffic only.

E. MAC address learning is not supported.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which statement about Layer 2 protocol participation of ports involved in a SPAN session is true?
A. Neither a SPAN source nor SPAN destination participates in any Layer 2 protocols.
B. A SPAN source does not participate in any Layer 2 protocols.
C. A SPAN destination does not participate in any Layer 2 protocols.
D. Both SPAN source and SPAN destination participate in any Layer 2 protocols.

A

C. A SPAN destination does not participate in any Layer 2 protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which three statements about RSPAN VLAN are true? (Choose three)
A. RSPAN VLAN traffic only flows on trunk ports.
B. RSPAN VLAN prevents from carrying traffic.
C. RSPAN VLAN can not be a private primary VLAN or secondary VLAN.
D. All RSPAN VLAN traffic is flooded.
E. RSPAN VLAN traffic only flows on access ports.
F. RSPAN VLAN does not support Spanning-Tree Protocol.

A

A. RSPAN VLAN traffic only flows on trunk ports.
C. RSPAN VLAN can not be a private primary VLAN or secondary VLAN.
D. All RSPAN VLAN traffic is flooded.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which statement about SPAN is true?
A. It is an industry-standard protocol for mirroring traffic
B. SPAN destinations participate in spanning-tree instances
C. It uses a specific VLAN to transfer mirrored traffic
D. It mirrors traffic from a source port to a destination port on the same switch only
E. SPAN destinations also can be SPAN sources

A

D. It mirrors traffic from a source port to a destination port on the same switch only

17
Q

For which reason would you configure RSPAN instead of SPAN on your network?
A. RSPAN provides more complete monitoring of the traffic on a single switch
B. Only RSPAN devices can monitor traffic on other device
C. Only RSPAN can log traffic on a VLAN that spans multiple switches
D. Only RSPAN supports STP on multiple switches across a campus

A

B. Only RSPAN devices can monitor traffic on other device

18
Q

Which two statements about Cisco StackWise are true? (Choose two)
A. It supports multiple switches in a stack
B. It supports both homogenious and mixed stacks
C. The LAN base feature set is supported on mixed stacks
D. Each stack identifies a stack master and a backup stack master
E. Stacks running the LAN base feature set support layer 3 features

A

A. It supports multiple switches in a stack

B. It supports both homogenious and mixed stacks

19
Q

Which statement is true about SPAN on a switch?
A. It would double the source traffic.
B. On every source port configured, there would be another port that can not be used
normally.
C. Hence source traffic….

A

A. It would double the source traffic.

20
Q

Which statement about RSPAN session is true?
A. Only the source switch in a session must support RSPAN.
B. The same RSPAN VLAN is used for a RSPAN session on all switches.
C. At least one access port must be configured in the RSPAN VLAN.
D. RSPAN support by default monitors at Layer 2.

A

B. The same RSPAN VLAN is used for a RSPAN session on all switches.

21
Q

Which two statements in relation to RSPAN are true? (Choose two)
A. RSPAN port will not learn MAC address.
B. RSPAN should be a trunk.
C. RSPAN port will learn MAC address

A

A. RSPAN port will not learn MAC address.

B. RSPAN should be a trunk.

22
Q

Which statement about the configuration of a trunk port as the source of a SPAN session is true?
A. Only VLANs that are configured individually as SPAN sources are monitored.
B. All VLANs in the trunk are monitored.
C. The trunk is errdisabled automatically.
D. All VLANs in the trunk are monitored, provided the SPAN destination port is a trunk.

A

B. All VLANs in the trunk are monitored.

23
Q

Which two statements about the monitored traffic in a SPAN session are true? (Choose two)
A. You cannot configure two separate SPAN or RSPAN source sessions with separate or overlapping sets of SPAN source ports and VLANs
B. By default, all monitored packets are captured without the IEEE 802.1Q tag
C. Egress SPAN monitors packets sent by the source interface before any QoS modifications
D. Sources can be ports or VLANs or any combination in the same session
E. By default, all monitored packets include the IEEE 802.1Q tag that they had on the source port
F. Ingress SPAN monitors packets received by the source interface before any QoS modifications

A

B. By default, all monitored packets are captured without the IEEE 802.1Q tag
F. Ingress SPAN monitors packets received by the source interface before any QoS modifications

24
Q

Which statement describes the result of configuring SPAN on a Cisco device?
A. SPAN doubles traffic internally.
B. SPAN halves the capacity of the source port.
C. SPAN blocks for normal use on one additional port for each configured source port.
D. If not carefully planned, SPAN can lead to loops between source and destination ports.

A

A. SPAN doubles traffic internally.

25
Q
Which mechanism is specific for RSPAN and not for SPAN?
A. source port
B. monitor port
C. reflector port
D. redundant port
E. destination port
A

C. reflector port

26
Q

Which two statements about source port monitoring in a SPAN are true? (Choose two)
A. Traffic through a destination port can be copied and included in the SPAN session
B. The entire EtherChannel must be monitored
C. It can monitor only FastEthernet and GigabitEthernet port types
D. It can monitor individual interfaces within a port channel
E. It can monitor ingress and egress traffic

A

D. It can monitor individual interfaces within a port channel
E. It can monitor ingress and egress traffic

27
Q

Which three statements about SPAN and RSPAN are true? (Choose three)
A. The switch port monitor provides data on network switches by port in use, CPU load and memory used.
B. It provides specific port data to obtain active and historical port utilization information.
C. Accurate information on unused switch ports helps the administrator keep these ports closed for security risk best practices.
D. Does not provide specific port data to obtain active and historical port utilization information.
E. Accurate information on unused switch ports is not necessary

A

A. The switch port monitor provides data on network switches by port in use, CPU load and memory used.
B. It provides specific port data to obtain active and historical port utilization information.
C. Accurate information on unused switch ports helps the administrator keep these ports closed for security risk best practices.

28
Q

Which two commands are correct to replicate incoming and outgoing traffic in a single interface? (Choose two)
A. monitor session 1 destination
B. monitor session 1 destination interface remote vlan
C. monitor session 1 source interface g0/1 tx
D. monitor session 1 source interface g0/2 rx
E. monitor session 1 source interface g0/1 both

A

B. monitor session 1 destination interface remote vlan

E. monitor session 1 source interface g0/1 both

29
Q

monitor session 1 source remote vlan 8 – 10
monitor session 1 destination interface fa0/1

Which of the following statement is correct?
A. The packet is sent to VLAN 8 and 10 and will be received in fa0/1
B. The packet is received from VLAN 8 and 10 and will be send to fa0/1
C. The packet is sent to VLAN 8 to 10 and will be received in fa0/1
D. The packet is received from VLAN 8 to 10 and will be sent to fa0/1

A

D. The packet is received from VLAN 8 to 10 and will be sent to fa0/1

30
Q

Which statement about VSPAN is true?
A. It can monitor ingress and egress traffic on the source VLAN
B. It sends all VLAN traffic to the destination port regardless of the VLAN’s status
C. It can monitor destination port traffic that belongs to a source VLAN
D. It can monitor token ring VLANs

A

A. It can monitor ingress and egress traffic on the source VLAN

31
Q

Which two commands configure RSPAN to capture incoming and outgoing traffic on a single interface? (Choose two)
A. monitor session 1 source interface gigabitethernet1/0/1 rx
B. monitor session 1 source interface gigabitethernet1/0/2 rx
C. monitor session 1 destination interface gigabitethernet1/0/2 rx
D. monitor session 1 destination remote vlan 910
E. monitor session 1 source interface gigabitethernet1/0/2 both

A

D. monitor session 1 destination remote vlan 910

E. monitor session 1 source interface gigabitethernet1/0/2 both

32
Q

Which statement about SPAN functionality for an EtherChannel group is true?
A. It can be configured as a SPAN source or a SPAN destination port.
B. It can be configured as a SPAN source but not as a SPAN destination port.
C. It can be configured as a SPAN destination but not as a SPAN source port.
D. It cannot be configured as a SPAN source or a SPAN destination port.

A

B. It can be configured as a SPAN source but not as a SPAN destination port.