Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: NetFlow, SPAN & RSPAN/ERSPANSwitch
All CCNP topics

4.0 Network Assurance

NetFlow, SPAN & RSPAN/ERSPAN Practice Questions

Flexible NetFlow components and traffic mirroring with SPAN/RSPAN/ERSPAN.

One solved question, so you can see how these are marked

In Cisco Flexible NetFlow (FNF), which component defines what flow fields are collected (such as source IP, destination IP, and protocol)?

Flow Record

The Flow Record contains the match (keys) and collect statements defining what parameters netflow measures.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 12 NetFlow, SPAN & RSPAN/ERSPAN questions in this set

Answers and explanations appear when you work through the set above.

  1. What key capability distinguishes ERSPAN (Encapsulated Remote SPAN) from standard RSPAN?

    • ERSPAN uses 802.1Q tags on a dedicated VLAN to extend mirrored traffic across switches.
    • ERSPAN encapsulates mirrored traffic in GRE so it can cross routed (Layer 3) networks.
    • ERSPAN can only mirror egress traffic, while RSPAN can mirror both directions of a port.
    • ERSPAN cannot mirror IPv6 source traffic, so it is used only on IPv4-only segments.

  2. Which open-standard telemetry protocol, codified in RFC 7011, evolved directly from Cisco NetFlow v9?

    • gRPC
    • IPFIX
    • sFlow
    • OpenFlow

  3. When configuring Remote SPAN (RSPAN), what dedicated layer 2 structure is required to carry mirrored traffic between switches?

    • GRE Tunnel
    • RSPAN VLAN
    • Control Plane Subinterface
    • VxLAN Overlay

  4. Which transport protocol does Flexible NetFlow use to export flow records to an external collector, and which collector port is commonly configured?

    • TCP, commonly port 22 over an SSH session
    • UDP, commonly port 2055 (4739 for IPFIX)
    • SCTP, commonly port 80 with HTTP framing
    • TCP, commonly port 443 inside an HTTPS POST

  5. What restriction applies to a destination port when configured in a standard Local SPAN session?

    • It can be used only as a member of an EtherChannel bundle toward the analyzer.
    • It stops normal switching and only transmits mirrored packets to the analyzer.
    • It must run at 10 Gbps or faster so it can carry all of the mirrored source traffic.
    • It automatically enables BPDU Guard and PortFast so the analyzer cannot form a loop.

  6. In Flexible NetFlow, which entity defines what fields are captured and analyzed (e.g., source IP, destination IP, layer 4 ports) from passing interface packets?

    • Flow Exporter
    • Flow Record
    • Flow Monitor
    • Flow Sampler

  7. What protocol header encapsulates mirrored traffic in ERSPAN, allowing spanned frames to be routed across Layer 3 IP networks to a remote collector?

    • VXLAN (UDP port 4789)
    • GRE (IP protocol 47)
    • IPsec ESP (IP protocol 50)
    • 802.1Q VLAN tagging (EtherType 0x8100)

  8. What command binds a configured Flexible NetFlow record and exporter together before application to an interface?

    • flow monitor <NAME>
    • flow exporter <NAME>
    • ip flow-export destination
    • sampler <NAME>

  9. When configuring Remote SPAN (RSPAN) to mirror traffic across a switched network, what special configuration must be applied to the designated RSPAN VLAN on all participating switches?

    • remote-span under the VLAN configuration
    • no ip igmp snooping vlan <ID>
    • no spanning-tree vlan <ID> globally
    • service-policy input SPAN-POLICY on each trunk

  10. When configuring a Local Switched Port Analyzer (SPAN) session on a Cisco Catalyst switch, what restriction applies to the SPAN destination port?

    • It keeps participating in STP normally, so it can block or forward like any other access port.
    • By default it does not carry normal user traffic or take part in Layer 2 switching while a destination.
    • It must be configured as an 802.1Q trunk so the mirrored frames keep their original VLAN tags.
    • It can only send the mirrored traffic to an external router, never to a local analyzer host.

  11. When configuring ERSPAN source and destination sessions across routed IP networks, what parameter must match on both ends to associate encapsulated GRE mirror streams?

    • ERSPAN ID (Session ID)
    • STP Priority Value
    • BGP Autonomous System Number
    • TACACS+ Server Key

  12. Which constraint must be adhered to when configuring a dedicated RSPAN VLAN across switches?

    • MAC learning is disabled on it, and end-user access ports must not be assigned to it.
    • It needs an SVI with an IP address and default gateway so the mirrored frames can be routed.
    • All RSPAN traffic must be encrypted with IPsec before it is allowed to cross the trunk links.
    • It can carry only untagged native frames, so it must be the native VLAN on every trunk.