5.3 Perform Packet Capture and Analysis Using Wireshark, Tcpdump, SPAN, ERSPAN, and RSPAN CCIE-SECURITY Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which tcpdump command-line option is used to specify the number of packets to capture before stopping?

   • A-n
   • B-i
   • C-c
   • D-w
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which BPF filter expression in tcpdump captures only packets destined for host 10.1.1.1?

   • Ahost 10.1.1.1
   • Bsrc host 10.1.1.1
   • Cdst host 10.1.1.1
   • Dnet 10.1.1.1
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of configuring a SPAN session on a Cisco switch?

   • ATo block unwanted traffic on a specific port
   • BTo encrypt traffic between two switches
   • CTo create a new VLAN for voice traffic
   • DTo mirror traffic from one or more source ports to a destination port
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which command is used to configure a SPAN session on a Cisco IOS switch, specifying the source interface?

   • Amonitor session 1 source interface gigabitethernet0/1
   • Bport mirroring source interface gigabitethernet0/1
   • Cspanning-tree portfast interface gigabitethernet0/1
   • Dswitchport monitor interface gigabitethernet0/1
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the key difference between SPAN and RSPAN?

   • ASPAN can only mirror traffic from a single port, while RSPAN can mirror multiple ports.
   • BRSPAN can mirror traffic across multiple switches, while SPAN is limited to a single switch.
   • CRSPAN requires a dedicated physical connection between switches, while SPAN does not.
   • DRSPAN encrypts the mirrored traffic, while SPAN does not.
   Reveal Solution Discussion Select an answer first