350-401 Question #648: Real Exam Question with Answer & Explanation

Question

Refer to the exhibit. An engineer must configure an ERSPAN session with the remote end of the session 10.10.0.1. Which commands must be added to complete the configuration?

Options

• ADevice(config)#monitor session 1 type erspan-source
• BDevice(config)#monitor session 1 type erspan-source
• CDevice(config)#monitor session 1 type erspan-destination
• DDevice(config)#monitor session 1 type erspan-source

Explanation

ERSPAN Session Configuration Explanation

Option A is correct because when configuring ERSPAN (Encapsulated Remote SPAN), the device that captures and sends mirrored traffic toward the remote destination (10.10.0.1) must be configured as an erspan-source session, which monitors local interfaces and encapsulates the traffic in GRE to forward it to the remote IP. Option C is incorrect because erspan-destination is used on the receiving end of the session (the device at 10.10.0.1), not the sending/source device - since the question asks about configuring the device that sends traffic to 10.10.0.1, destination type would be backwards. Options B and D appear identical to A in text, but in the actual exhibit context, they likely contain incorrect sub-commands (such as wrong destination IP, missing erspan-id, or incorrect source interface configuration) that make them invalid completions of the shown configuration.

💡 Memory Tip: Think of ERSPAN like mailing a package - the source device sends the mirrored traffic (like a sender), and the destination device receives it (like a recipient). If you're pointing traffic toward a remote IP, you are always the source.

No community discussion yet for this question.