Cisco CCNP Enterprise 350-401 ENCOR Diagnostics Flexible NetFlow and Traffic Mirroring Practice Test

 

Topic 12 covers diagnostics, flexible netflow and traffic mirroring for the Cisco Certified Specialist – Enterprise Core certification. These original practice questions apply the verified 350-401 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

A router has interfaces in the global table and VRF CUST-A. Users in CUST-A report that 10.20.30.40 is unreachable. A normal ping from the router succeeds because it uses the global route. Which test most directly checks the customer routing context?

1. Increase the ICMP timeout on the global ping.
2. Ping 10.20.30.40 from the CUST-A VRF or a CUST-A source.
3. Run traceroute without a source and accept the first successful hop.
4. Ping the router loopback only.
5. Clear the ARP cache before every ping.

Correct Answer: B

 

Correct Answer

Answer B is correct because the test must originate in the same routing context as the affected traffic.

Incorrect Answers

Answer A is incorrect because a longer timeout does not test the affected routing table.

Answer C is incorrect because an unspecified source can still use the global routing context and does not isolate CUST-A.

Answer D is incorrect because that proves local IP operation, not reachability from CUST-A.

Answer E is incorrect because ARP clearing changes local neighbor state but does not select the customer VRF.

 

Question 2

A traceroute toward 203.0.113.50 shows hops 1 and 2, then `* * *` for hop 3, and later shows hops 4 through 7 including the destination. What is the strongest conclusion from this evidence alone?

3. The route contains a forwarding loop at hop 3.
4. The path changed from UDP to TCP at hop 3.
5. Hop 3 is dropping all transit packets.
6. The destination is intermittently unreachable.
7. Hop 3 omitted its reply; forwarding may have continued.

Correct Answer: E

 

Correct Answer

Answer E is correct because routers may forward traffic while rate-limiting or not generating TTL-expired responses.

Incorrect Answers

Answer A is incorrect because a loop would normally reveal repeated hops or prevent later progress, neither of which is shown.

Answer B is incorrect because the output does not establish a transport-mode change.

Answer C is incorrect because later hops and the destination respond, so transit traffic can pass beyond that point.

Answer D is incorrect because the trace reaches the destination in the stated observation.

 

Question 3

A core router is carrying millions of flows. Only TCP sessions from 10.1.4.0/24 to 172.16.20.10 port 443 reset during a short interval. An engineer wants packet-level debug evidence without generating output for unrelated traffic. What is the safest diagnostic approach among these choices?

1. Mirror every VLAN to one analyzer and then enable all protocol debugs.
2. Use a bounded conditional debug matching the affected source, destination, and flow.
3. Enable an unrestricted packet debug during the peak period.
4. Clear all sessions immediately before debugging.
5. Raise logging severity so every informational message is suppressed.

Correct Answer: B

 

Correct Answer

Answer B is correct because conditioning limits debug processing/output to the traffic under investigation.

Incorrect Answers

Answer A is incorrect because this expands rather than narrows collection and can overload the analyzer.

Answer C is incorrect because broad debugging on a busy core can create excessive CPU/output and includes irrelevant flows.

Answer D is incorrect because destroying state can remove the condition to be observed and is unnecessarily disruptive.

Answer E is incorrect because that may hide evidence but does not target the affected packets.

 

Question 4

A branch can ping a SaaS server IP with stable 25-ms replies, but HTTPS connections to TCP/443 fail consistently. Which interpretation is best?

1. The branch default gateway is necessarily failing.
2. The successful ping proves the HTTPS application is available.
3. Increase the ICMP payload until HTTPS succeeds.
4. The problem must be DNS because the test used an IP address.
5. IP reachability is working, but service availability still needs a protocol/port-appropriate test.

Correct Answer: E

 

Correct Answer

Answer E is correct because the two tests answer different questions and successful ICMP cannot establish TCP/HTTPS health.

Incorrect Answers

Answer A is incorrect because successful end-to-end ICMP makes total gateway loss inconsistent with the observation.

Answer B is incorrect because ICMP reachability does not test the server process, TCP port, TLS path or intervening policy for HTTPS.

Answer C is incorrect because changing ICMP size does not directly test the application listener.

Answer D is incorrect because using an IP bypasses DNS, so this evidence does not make DNS the cause.

 

Question 5

A distribution switch shows high CPU and brief forwarding complaints. You need first-pass evidence about which interfaces are discarding traffic and when, while minimizing additional processing. What should you collect first?

1. Full packet debugging for all interfaces.
2. A continuous ERSPAN copy of every switch port.
3. Reload the switch to reset CPU usage.
4. Start with counters and timestamped logs, then narrow diagnostics.
5. Repeatedly clear all interface counters so only new values remain.

Correct Answer: D

 

Correct Answer

Answer D is correct because existing counters/logs are low-impact and can identify scope before heavier debug/capture.

Incorrect Answers

Answer A is incorrect because broad debug can worsen CPU pressure and produces far more data than needed initially.

Answer B is incorrect because large-scale mirroring can add load and overwhelm the destination.

Answer C is incorrect because reload is disruptive and removes the opportunity to collect evidence about the active condition.

Answer E is incorrect because clearing destroys useful historical deltas before the scope is established.

 

Question 6

A monitoring server must learn the current `ifInErrors` value every five minutes even when no threshold event occurs. Which mechanism fits that requirement?

1. Configure only an SNMP trap for linkDown.
2. Wait for syslog severity 0 messages.
3. Use an unsolicited SNMP notification and assume it contains every counter.
4. Poll the relevant SNMP object at the required interval.
5. Run traceroute from the switch every five minutes.

Correct Answer: D

 

Correct Answer

Answer D is correct because polling actively retrieves current MIB values on schedule.

Incorrect Answers

Answer A is incorrect because a link notification does not supply periodic counter values when the link remains up.

Answer B is incorrect because syslog emergencies do not provide periodic MIB counter collection.

Answer C is incorrect because notifications are event-driven and do not inherently deliver arbitrary periodic values.

Answer E is incorrect because traceroute observes path hops rather than MIB interface counters.

 

Question 7

A switch sends messages to a remote syslog server with `logging trap warnings`. An interface event is logged locally at severity 6 (informational), but the server never receives it. Connectivity to the server is good. What most directly explains the result?

1. The remote threshold excludes severity 6 informational messages.
2. SNMP UDP/161 is blocked.
3. Severity 6 is more severe than warnings and must be sent.
4. The interface cannot generate syslog while it is administratively up.
5. The message must first be converted to an SNMP trap.

Correct Answer: A

 

Correct Answer

Answer A is correct because syslog severity filtering can suppress less-severe messages from a destination.

Incorrect Answers

Answer B is incorrect because syslog delivery is not SNMP polling on UDP/161.

Answer C is incorrect because syslog severity numbering is inverse: lower numbers are more severe.

Answer D is incorrect because interfaces can generate many informational events while up.

Answer E is incorrect because syslog can be sent directly and does not require SNMP conversion.

 

Question 8

Three routers report a short routing event, but their remote syslog lines contain no timestamps and arrive at the collector in an order affected by WAN delay. Why is root-cause sequencing difficult?

1. SNMP polling automatically reconstructs exact event time.
2. The routers must use identical hostnames for correlation.
3. Severity values cannot be compared between Cisco devices.
4. The collector cannot receive UDP without timestamps.
5. Unsynchronized timestamps weaken event chronology.

Correct Answer: E

 

Correct Answer

Answer E is correct because network delay can reorder when events reach the collector relative to when they occurred.

Incorrect Answers

Answer A is incorrect because polling later cannot retroactively create timestamps for already generated events.

Answer B is incorrect because identical names would make source attribution worse and still would not supply event time.

Answer C is incorrect because standard severity levels are comparable; the missing time context is the decisive issue.

Answer D is incorrect because syslog transport can still deliver lines; the problem is event ordering, not basic delivery.

 

Question 9

A switch forwards production traffic normally, but the NMS suddenly cannot poll it. The management interface is in a separate VRF. Which next test best avoids conflating management reachability with data-plane forwarding?

1. Move SNMP onto a production user VLAN without testing the current path.
2. Change all SNMP communities immediately.
3. Test management-path IP reachability first, then verify SNMP service.
4. Clear the production routing table.
5. Declare a forwarding outage because SNMP polling failed.

Correct Answer: C

 

Correct Answer

Answer C is correct because this separates path reachability from protocol/credential issues while leaving production forwarding intact.

Incorrect Answers

Answer A is incorrect because that changes architecture rather than diagnosing the management-plane problem.

Answer B is incorrect because credentials may matter, but first the stated management VRF reachability should be tested separately.

Answer D is incorrect because that is disruptive and unrelated to first isolating the management path.

Answer E is incorrect because management-plane loss does not prove user transit traffic is failing.

 

Question 10

At 10:15:02 an interface logs a carrier transition. Its CRC counter is 120 at 10:14 and 4,980 at 10:16. A routing adjacency resets at 10:15:04. Which use of this evidence is strongest?

1. Reset all counters and logs before any further test.
2. Correlate the error spike and carrier event with the adjacency reset.
3. Ignore the interface counters because syslog is always more authoritative.
4. The CRC increase proves the routing protocol caused a physical fault.
5. The adjacency reset proves the CRC counter is inaccurate.

Correct Answer: B

 

Correct Answer

Answer B is correct because the timing and interface evidence justify focusing verification on the link without claiming unsupported causality.

Incorrect Answers

Answer A is incorrect because clearing the evidence would hinder confirmation of the pattern.

Answer C is incorrect because counter deltas are material evidence about the link and complement event logs.

Answer D is incorrect because temporal association does not establish that routing caused Layer 1 corruption.

Answer E is incorrect because both observations can coexist and may represent cause/effect or a common fault.

 

Question 11

Traffic from A to B works, but traffic from B to A loses about 40%. A single bidirectional ping summary from A shows intermittent replies. What is the best next inference/test strategy?

1. Replace the default gateway on A immediately.
2. Increase TTL because loss percentage is caused by hop count.
3. Measure each direction separately from appropriate endpoints or telemetry.
4. Assume the forward direction is faulty because A initiated the ping.
5. Treat the path as completely down in both directions.

Correct Answer: C

 

Correct Answer

Answer C is correct because one round-trip result cannot by itself identify which direction loses packets.

Incorrect Answers

Answer A is incorrect because the evidence does not yet isolate a gateway.

Answer B is incorrect because TTL does not explain the stated directional asymmetry.

Answer D is incorrect because a lost echo can result from loss of either request or reply.

Answer E is incorrect because some requests/replies succeed and the statement specifically identifies directional loss.

 

Question 12

A router has VRFs BLUE and RED, both containing 10.50.0.0/16. Users in BLUE cannot reach 10.50.1.10. The engineer runs `ping 10.50.1.10 vrf RED` and gets replies, then declares BLUE healthy. What is wrong with the test?

1. ICMP cannot operate inside a VRF.
2. A successful ping always tests both VRFs.
3. The RED test does not verify BLUE.
4. The destination must have a public address.
5. The engineer should disable both VRFs before testing.

Correct Answer: C

 

Correct Answer

Answer C is correct because overlapping addresses make the selected VRF a decisive part of the test.

Incorrect Answers

Answer A is incorrect because VRF-aware ping is specifically used to test a routing context.

Answer B is incorrect because VRFs are separate routing tables; success in one does not establish the other.

Answer D is incorrect because private addressing is not the issue. It does not satisfy the stem’s governing point: With overlapping VRFs, a diagnostic command must select the affected routing context.

Answer E is incorrect because that would destroy the conditions under investigation. It does not satisfy the stem’s governing point: With overlapping VRFs, a diagnostic command must select the affected routing context.

 

Question 13

A router answers pings to its own loopback from a remote site, but packets routed through that router toward a server fail. Which conclusion is justified?

1. The remote site has no route to the router.
2. The loopback response proves the server is available.
3. ICMP replies can occur only when CEF is disabled.
4. Local control-plane reachability and transit forwarding are distinct; test the forwarded path and relevant interfaces/policies separately.
5. Successful control-plane response proves transit forwarding through the router is healthy.

Correct Answer: D

 

Correct Answer

Answer D is correct because the evidence proves reachability to the router itself, not successful transit across it.

Incorrect Answers

Answer A is incorrect because it successfully reaches the loopback. It does not satisfy the stem’s governing point: Do not equate reachability to a router address with successful transit forwarding through the device.

Answer B is incorrect because the server is a different endpoint and path beyond the router.

Answer C is incorrect because that is not a general requirement and is unsupported by the observation.

Answer E is incorrect because a packet addressed to the router can be processed locally while transit forwarding has a separate problem.

 

Question 14

Client C reaches R1, R1 reaches R2, and R2 reaches the server when each test originates locally. An end-to-end trace from C stops after R2. Server return routes are verified. R2 output-interface counters show increasing ACL drops only for the client subnet. Where should troubleshooting focus first?

1. R2 output policy/ACL toward the server.
2. R1 input interface.
3. The server NIC.
4. DNS configuration.
5. Client C access link.

Correct Answer: A

 

Correct Answer

Answer A is correct because multiple observations converge on the R2 egress policy as the first evidenced failing point.

Incorrect Answers

Answer B is incorrect because R1 reaches R2 and there is direct evidence at R2 output.

Answer C is incorrect because R2 output ACL drops indicate packets are being discarded before reaching the server.

Answer D is incorrect because the tests identify an IP forwarding/policy issue, not name resolution.

Answer E is incorrect because C already reaches R1 and the decisive drop counter is farther downstream.

 

Question 15

A user reports a 30-second outage at 03:00. The switch has no relevant local log entries, but logging was configured to keep only severity 3 and more severe messages. Interface counters and the upstream device show a link flap at 03:00. What should you conclude?

1. The upstream log must be fabricated because the local switch is authoritative.
2. No switch event occurred because there is no local log line.
3. The link flap is impossible if interface counters changed.
4. The switch definitely rebooted.
5. The local log is incomplete for this question; use the configured severity/retention scope plus other evidence before deciding whether the event occurred.

Correct Answer: E

 

Correct Answer

Answer E is correct because the observation boundary of the log must be understood before treating silence as negative evidence.

Incorrect Answers

Answer A is incorrect because different logging policies can produce different retained evidence.

Answer B is incorrect because the configured logging threshold can omit less-severe events, so absence from that log is not proof of absence.

Answer C is incorrect because counters and upstream logs actually support the possibility of a link event.

Answer D is incorrect because nothing in the evidence establishes a reboot. It does not satisfy the stem’s governing point: Absence of a log record is not proof an event did not occur when logging thresholds or retention can exclude it.

 

Question 16

An engineer creates a custom flow record with match fields and collect fields, and separately configures a collector destination. Which Flexible NetFlow object combines the record with an exporter and maintains the flow cache when applied?

1. SPAN session.
2. Flow sampler.
3. Class map.
4. Flow exporter.
5. Flow monitor.

Correct Answer: E

 

Correct Answer

Answer E is correct because the monitor references a flow record, can reference exporters, maintains cache state, and is attached to an interface.

Incorrect Answers

Answer A is incorrect because SPAN copies packets rather than defining NetFlow cache/export state.

Answer B is incorrect because a sampler controls observation sampling and is not the object that combines the record and exporter.

Answer C is incorrect because a QoS class map is not the FNF monitor object.

Answer D is incorrect because the exporter defines how/where records are sent, not the full cache/record association used on an interface.

 

Question 17

The goal is to distinguish flows by source address, destination address, IP protocol, source port and destination port. Which fields belong in the flow record as `match` keys?

1. Only the exporter address and UDP port.
2. Only packet and byte counters.
3. The five stated header fields.
4. Interface description and hostname only.
5. Syslog severity and facility.

Correct Answer: C

 

Correct Answer

Answer C is correct because match fields define the key used to partition traffic into distinct flow entries.

Incorrect Answers

Answer A is incorrect because those describe the export destination, not observed-flow identity.

Answer B is incorrect because counters are collected measurements and do not define flow identity.

Answer D is incorrect because those metadata do not satisfy the stated five-tuple distinction.

Answer E is incorrect because those are logging attributes unrelated to NetFlow keys.

 

Question 18

A custom record already keys on source/destination address and transport ports. Operations wants byte and packet totals for each existing flow without causing two otherwise identical flows to become separate entries. How should those totals be added?

1. Add byte and packet counters as collected non-key fields.
2. Use the collector UDP port as the byte counter.
3. Convert the monitor to SPAN.
4. Place counters in the exporter destination.
5. Add each counter as a new match field.

Correct Answer: A

 

Correct Answer

Answer A is correct because collect fields add measurements to each flow entry without redefining the key.

Incorrect Answers

Answer B is incorrect because transport port identifies the export service, not observed traffic volume.

Answer C is incorrect because packet mirroring is a different visibility mechanism. It does not satisfy the stem’s governing point: Use `collect` fields for per-flow measurements such as packet/byte counters when they should not change flow identity.

Answer D is incorrect because exporter configuration does not define per-flow measurements. It does not satisfy the stem’s governing point: Use `collect` fields for per-flow measurements such as packet/byte counters when they should not change flow identity.

Answer E is incorrect because changing match fields changes flow identity and is inappropriate for accumulated counters.

 

Question 19

A monitor is attached only as input on Gi1/0/10. The team expects to analyze traffic that leaves Gi1/0/10 after being routed from other interfaces, but the cache remains empty for those egress-only packets. What change matches the requirement?

1. Change the exporter to TCP.
2. Remove every match field from the record.
3. Add an RSPAN VLAN.
4. Attach or configure the monitor for the appropriate output direction, subject to platform support.
5. Increase syslog severity.

Correct Answer: D

 

Correct Answer

Answer D is correct because the stated traffic is egress-only relative to this interface, while the monitor is observing ingress.

Incorrect Answers

Answer A is incorrect because transport to the collector does not change which interface direction is observed.

Answer B is incorrect because that would not correct interface direction. It does not satisfy the stem’s governing point: Flexible NetFlow observation is direction-specific at the interface; monitor attachment must match the traffic direction of interest.

Answer C is incorrect because RSPAN is packet mirroring and does not alter NetFlow monitor direction.

Answer E is incorrect because logging threshold is unrelated to FNF observation direction.

 

Question 20

A flow monitor cache is populated correctly, but the collector at 192.0.2.50:2055 receives nothing. The exporter is configured to 192.0.2.5 port 2055 and routing to both addresses exists. What is the most direct correction?

1. Enable PIM sparse mode.
2. Move the monitor from input to output.
3. Change the flow record keys.
4. Change the exporter destination to 192.0.2.50.
5. Clear the cache every second.

Correct Answer: D

 

Correct Answer

Answer D is correct because the configured collector address does not match the actual collector.

Incorrect Answers

Answer A is incorrect because multicast routing is unrelated to unicast NetFlow export.

Answer B is incorrect because cache population proves the current observation sees traffic; the export destination is the mismatch.

Answer C is incorrect because the cache already proves the record is classifying traffic.

Answer E is incorrect because frequent clearing does not send records to the correct collector.

 

Question 21

A flow monitor is configured on Gi1/0/20 input with a valid record/exporter. `show flow monitor … cache` stays empty while users say traffic is heavy. Interface counters also show zero input packets but large output counters. What is the best explanation?

1. SNMP polling disabled NetFlow.
2. The exporter template is corrupt.
3. The observed traffic is leaving the interface, while the monitor watches input.
4. The flow record has too many collect fields.
5. The collector is unreachable.

Correct Answer: C

 

Correct Answer

Answer C is correct because the interface counters directly support a direction mismatch.

Incorrect Answers

Answer A is incorrect because SNMP and FNF are independent visibility mechanisms. It does not satisfy the stem’s governing point: Use interface direction/counters to explain an empty FNF cache before blaming export when the monitored direction sees no packets.

Answer B is incorrect because an export-template issue does not explain an empty local cache when no monitored-direction packets arrive.

Answer D is incorrect because the observation-direction evidence is more direct and collected fields do not inherently prevent cache creation.

Answer E is incorrect because unreachable export can still leave local cache entries.

 

Question 22

A monitor shows hundreds of active and expired flow entries locally. The collector receives none. A packet capture on the exporter source interface shows no export datagrams leaving. What should be checked next?

1. Whether users are generating any flows.
2. STP root priority on an unrelated access VLAN.
3. The number of IGMP receivers.
4. Whether the collector has a NetFlow template decoder.
5. Exporter configuration, source reachability and monitor-to-exporter association.

Correct Answer: E

 

Correct Answer

Answer E is correct because local records prove classification/cache operation; absent export packets points to export configuration/activation.

Incorrect Answers

Answer A is incorrect because the local cache already proves observed flows exist.

Answer B is incorrect because that does not explain local cache with no export packets.

Answer C is incorrect because multicast membership is unrelated to NetFlow export activation.

Answer D is incorrect because decoder problems occur after datagrams arrive; none are leaving the source interface.

 

Question 23

A NetFlow v9/IPFIX collector receives data records after a restart but cannot decode field boundaries until it later receives the associated template. What characteristic explains this?

1. SPAN destination ports supply the missing metadata.
2. The collector derives every field from Ethernet type values.
3. The switch encrypts the field layout in syslog.
4. BGP attributes describe each NetFlow record.
5. Template-based export communicates the field layout used by subsequent data records.

Correct Answer: E

 

Correct Answer

Answer E is correct because templates describe the record structure needed to interpret flexible exported data.

Incorrect Answers

Answer A is incorrect because SPAN is raw packet mirroring, not flow-template exchange.

Answer B is incorrect because flow export records can contain customizable fields not inferable solely from packet EtherType.

Answer C is incorrect because syslog is not the mechanism that defines NetFlow record fields.

Answer D is incorrect because BGP is unrelated to export schema. It does not satisfy the stem’s governing point: Template-based flow export requires collectors to know the template that describes the variable record structure.

 

Question 24

A monitor is configured to sample 1 out of every 100 packets. During a short burst, the collector reports no flow for a specific five-packet transaction. Which statement is most accurate?

1. Convert the five packets to multicast.
2. Increase the syslog severity to make sampled packets appear.
3. The collector proves all five packets were dropped.
4. The transaction definitely never crossed the interface.
5. Sampling provides observations, not a complete packet-by-packet record; use packet capture or unsampled evidence if every packet matters.

Correct Answer: E

 

Correct Answer

Answer E is correct because a sample intentionally does not observe every packet.

Incorrect Answers

Answer A is incorrect because traffic type conversion is irrelevant to observation completeness.

Answer B is incorrect because syslog thresholds do not change NetFlow sampling. It does not satisfy the stem’s governing point: Sampled flow telemetry cannot prove the absence of individual packets or short transactions.

Answer C is incorrect because absence from sampled telemetry is not packet-drop proof.

Answer D is incorrect because sampling can miss a small transaction even when it occurred.

 

Question 25

A collector dashboard appears several minutes behind short-lived flows even though export connectivity is healthy. The monitor uses a long inactive timeout and long active timeout. What tuning most directly affects export freshness?

1. Remove timestamps from syslog.
2. Use appropriate active/inactive cache timeouts so completed/long-lived flows are exported at a cadence matching the monitoring need.
3. Increase STP hello time.
4. Lower HSRP priority.
5. Disable all record keys.

Correct Answer: B

 

Correct Answer

Answer B is correct because cache timeouts influence when records are aged/exported from the monitor.

Incorrect Answers

Answer A is incorrect because syslog formatting is independent. It does not satisfy the stem’s governing point: Flexible NetFlow cache aging/export timers affect how quickly flow observations become visible at a collector.

Answer C is incorrect because spanning-tree timing does not control NetFlow cache export.

Answer D is incorrect because FHRP election does not determine flow-record aging. It does not satisfy the stem’s governing point: Flexible NetFlow cache aging/export timers affect how quickly flow observations become visible at a collector.

Answer E is incorrect because that destroys useful flow identity and is not the normal freshness control.

 

Question 26

A packet analyzer is connected to Gi1/0/48 on the same access switch as the suspect server on Gi1/0/10. The engineer needs a copy of the server traffic without routing the mirrored packets elsewhere. Which method is simplest?

48. Local SPAN from Gi1/0/10 to Gi1/0/48.
49. ERSPAN to a remote IP endpoint.
50. SNMP polling of interface counters.
51. RSPAN through a dedicated VLAN.
52. Flexible NetFlow export only.

Correct Answer: A

 

Correct Answer

Answer A is correct because local SPAN directly copies selected local source traffic to a local destination analyzer port.

Incorrect Answers

Answer B is incorrect because ERSPAN is useful across routed transport but is unnecessary for a local analyzer on the same switch.

Answer C is incorrect because counters do not provide packet payload/header copies. It does not satisfy the stem’s governing point: Use local SPAN when both source and analyzer destination are on the same switch.

Answer D is incorrect because RSPAN is intended to carry mirrored traffic across Layer 2 switches; no remote switch is needed here.

Answer E is incorrect because flow telemetry summarizes flows and does not provide the requested packet copies.

 

Question 27

The source port is on Access-1 and the analyzer is on Access-3. The switches are connected by Layer 2 trunks, and the design must not require an IP-routed tunnel for the mirror traffic. Which technique fits?

1. ERSPAN because every remote analyzer requires GRE/IP.
2. NetFlow because it reproduces complete packets.
3. Local SPAN on Access-1 only.
4. RSPAN using an RSPAN VLAN carried across the Layer 2 path.
5. NTP because the analyzer is remote.

Correct Answer: D

 

Correct Answer

Answer D is correct because RSPAN transports mirrored frames between switches through a designated VLAN.

Incorrect Answers

Answer A is incorrect because a Layer 2 RSPAN path is explicitly available, so routed encapsulation is not required.

Answer B is incorrect because NetFlow exports flow records rather than full mirrored packets.

Answer C is incorrect because a local destination port cannot reach an analyzer physically attached to Access-3.

Answer E is incorrect because time synchronization does not transport mirrored traffic. It does not satisfy the stem’s governing point: RSPAN extends a mirror session across a Layer 2 switching path using an RSPAN VLAN.

 

Question 28

A source switch and security analyzer are in different campuses separated by an IP-routed WAN with no common Layer 2 VLAN. The analyzer must receive mirrored packet copies. Which method is designed for this topology?

1. SNMP traps to the analyzer.
2. Local SPAN to the WAN uplink.
3. Syslog with debug severity.
4. ERSPAN to the analyzer/ERSPAN destination over routed IP transport.
5. RSPAN with the same VLAN number at both ends but no Layer 2 continuity.

Correct Answer: D

 

Correct Answer

Answer D is correct because ERSPAN encapsulates mirrored traffic for delivery across a routed network.

Incorrect Answers

Answer A is incorrect because SNMP notifications are management events, not mirrored packets.

Answer B is incorrect because making the WAN uplink a SPAN destination does not create an analyzable routed tunnel.

Answer C is incorrect because syslog messages cannot replace packet copies. It does not satisfy the stem’s governing point: ERSPAN is appropriate when mirrored traffic must traverse routed IP transport.

Answer E is incorrect because RSPAN relies on Layer 2 carriage of its RSPAN VLAN.

 

Question 29

A local SPAN session is configured with Gi1/0/12 as the source and Gi1/0/48 as the destination. Which statement correctly describes the roles?

1. The source port stops forwarding production traffic.
2. Gi1/0/48 is where the switch copies selected source traffic for the analyzer.
3. Gi1/0/48 is automatically included as another source.
4. Gi1/0/12 must be connected to the analyzer.
5. Both ports become routing adjacencies.

Correct Answer: B

 

Correct Answer

Answer B is correct because the SPAN destination receives copies from the monitored source.

Incorrect Answers

Answer A is incorrect because SPAN generally observes/copies source traffic rather than turning the source into an analyzer-only port.

Answer C is incorrect because a destination is not implicitly a monitored source.

Answer D is incorrect because the stated source is the interface whose traffic is observed.

Answer E is incorrect because SPAN does not create routing peers. It does not satisfy the stem’s governing point: In SPAN, source interfaces/VLANs are observed; the destination port receives the copies for analysis.

 

Question 30

A server complaint involves only responses leaving Gi1/0/10 toward the server. The SPAN session currently mirrors `rx` on Gi1/0/10 and the analyzer sees requests entering but not responses leaving. What change best targets the missing evidence?

1. Change the destination analyzer port into an RSPAN VLAN.
2. Disable the source interface to force packets into the capture.
3. Change the server MAC address.
4. Increase SNMP poll frequency.
5. Mirror the transmit/egress direction (or both directions if needed) on the source interface.

Correct Answer: E

 

Correct Answer

Answer E is correct because the desired response packets are leaving the interface, so receive-only selection omits them.

Incorrect Answers

Answer A is incorrect because the analyzer is already local; source direction is the stated mismatch.

Answer B is incorrect because that eliminates the traffic rather than observing it.

Answer C is incorrect because address changes do not correct SPAN direction. It does not satisfy the stem’s governing point: SPAN source direction must include the ingress/egress direction containing the packets of interest.

Answer D is incorrect because polling cannot make omitted packet directions appear in SPAN.

 

Question 31

An RSPAN source session on Access-1 sends copies into VLAN 999. Access-3 has the RSPAN destination session. VLAN 999 is defined as an RSPAN VLAN on both, but an intermediate trunk prunes VLAN 999. What is the most direct consequence?

1. The switches automatically convert RSPAN to ERSPAN.
2. Only production traffic in VLAN 999 is affected, never mirror copies.
3. The analyzer can still receive copies because RSPAN ignores trunk VLAN carriage.
4. The mirrored copies cannot reach Access-3 across that pruned trunk.
5. NetFlow export repairs the RSPAN path.

Correct Answer: D

 

Correct Answer

Answer D is correct because pruning the RSPAN VLAN breaks its transport path.

Incorrect Answers

Answer A is incorrect because there is no automatic conversion to routed ERSPAN.

Answer B is incorrect because the RSPAN VLAN specifically carries the mirrored traffic.

Answer C is incorrect because RSPAN frames need the RSPAN VLAN to traverse the intervening Layer 2 path.

Answer E is incorrect because flow export is a different telemetry mechanism. It does not satisfy the stem’s governing point: RSPAN requires its designated VLAN to be carried end-to-end across the Layer 2 path.

 

Question 32

An ERSPAN source session is up, but packet captures on the source switch show encapsulated ERSPAN packets being dropped because the configured destination IP has no route. What should be fixed first?

1. Increase the source SPAN destination port speed.
2. Change the mirrored application from TCP to UDP.
3. Disable CEF globally.
4. Add/restore IP reachability to the ERSPAN destination through the intended routing table.
5. Create an RSPAN VLAN on every routed WAN hop.

Correct Answer: D

 

Correct Answer

Answer D is correct because ERSPAN relies on routed IP delivery to its destination.

Incorrect Answers

Answer A is incorrect because the failure is before a local destination port; the ERSPAN tunnel destination is unreachable.

Answer B is incorrect because the production transport protocol does not fix tunnel destination routing.

Answer C is incorrect because that is disruptive and not a justified remedy for a missing route.

Answer E is incorrect because RSPAN VLANs do not cross arbitrary routed WANs.

 

Question 33

A 10-Gb/s source can burst near line rate. Its local SPAN destination is a 1-Gb/s analyzer port. During bursts, the analyzer capture shows gaps while production forwarding remains healthy. Which explanation is most likely?

1. The mirror destination is oversubscribed and cannot receive every copied packet at the source burst rate.
2. The production source must also be limited to 1 Gb/s by SPAN.
3. RPF is rejecting unicast packet copies.
4. SNMP polling causes a 9-Gb/s bandwidth reservation.
5. NTP offsets delete packets from packet captures.

Correct Answer: A

 

Correct Answer

Answer A is correct because a lower-capacity SPAN destination can drop mirror copies without implying production packet loss.

Incorrect Answers

Answer B is incorrect because SPAN destination limitations do not normally throttle the production source to analyzer speed.

Answer C is incorrect because RPF is a multicast forwarding concept and does not explain local SPAN oversubscription.

Answer D is incorrect because SNMP does not reserve that bandwidth. It does not satisfy the stem’s governing point: A mirror destination can lose copies when aggregate mirrored traffic exceeds its capacity even if production forwarding is unaffected.

Answer E is incorrect because clock sync affects timestamps, not physical analyzer-port capacity.

 

Question 34

An analyzer connected to a SPAN destination sees a TCP SYN copied from the source interface. The application server still reports that it never received the SYN. What does the capture prove?

1. It proves the SYN-ACK was returned.
2. It proves there are no ACLs downstream.
3. It proves only that the switch observed and copied the SYN at the configured source point; downstream delivery still needs separate evidence.
4. It proves DNS resolved correctly.
5. It proves the server TCP stack accepted the SYN.

Correct Answer: C

 

Correct Answer

Answer C is correct because SPAN observation at one point does not prove the packet successfully traversed every later hop.

Incorrect Answers

Answer A is incorrect because only the SYN is stated as observed. It does not satisfy the stem’s governing point: A mirrored packet copy establishes observation at the source point, not end-to-end delivery.

Answer B is incorrect because downstream policy could still drop the original after the observation point.

Answer D is incorrect because the packet observation does not establish name-resolution behavior.

Answer E is incorrect because a copy at the source interface says nothing about server receipt or stack processing.

 

Question 35

A VLAN-based SPAN session is intended to mirror VLAN 20, but the configured source is VLAN 30. The analyzer receives plenty of traffic, yet none from the affected VLAN 20 hosts. What should be corrected?

30. Change every VLAN 20 host to VLAN 30.
31. Change the source VLAN in the mirror session to VLAN 20.
32. Raise the analyzer MTU only.
33. Enable BGP on the analyzer.
34. Disable all VLAN pruning.

Correct Answer: B

 

Correct Answer

Answer B is correct because the session is observing the wrong VLAN despite otherwise working mirroring.

Incorrect Answers

Answer A is incorrect because that alters production design rather than correcting the observation scope.

Answer C is incorrect because MTU does not explain why an entirely different source VLAN is selected.

Answer D is incorrect because routing protocol configuration is irrelevant to local mirror-source selection.

Answer E is incorrect because the stated local session already receives traffic; the source definition is the explicit mismatch.