5.3 Perform Packet Capture and Analysis Using Wireshark, Tcpdump, SPAN, ERSPAN, and RSPAN CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A network engineer is configuring SPAN on a switch to monitor traffic from a server port. The monitoring device is connected to a port on the same switch. The engineer wants to ensure that the SPAN session does not affect the performance of the switch. Which configuration should be used?

   • AConfigure SPAN with a single source port and a single destination port, and limit the traffic direction to ingress only.
   • BConfigure SPAN with multiple source ports and a single destination port.
   • CConfigure RSPAN with a remote VLAN to offload the mirroring to another switch.
   • DConfigure ERSPAN to encapsulate the traffic and send it to a remote server.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A network team is planning to implement remote monitoring across multiple switches. The team needs to mirror traffic from a server on switch A to a monitoring station on switch C. The switches are connected via a Layer 2 network, but the team wants to avoid using a dedicated VLAN for the mirrored traffic due to VLAN limitations. Which alternative method should they use?

   • AUse tcpdump on the server to capture traffic and send the file to the monitoring station.
   • BConfigure local SPAN on switch A and connect the monitoring station to a port on switch A.
   • CConfigure ERSPAN on switch A to send the mirrored traffic directly to the monitoring station's IP address.
   • DConfigure RSPAN with a VLAN that is already in use for other purposes.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security analyst is troubleshooting a network issue and needs to capture traffic from a remote switch. The analyst has access to the switch's management interface and can configure ERSPAN. However, the monitoring server is behind a firewall that only allows specific ports. Which consideration is critical for the ERSPAN configuration to work?

   • AEnsure that the firewall allows GRE protocol (IP protocol 47) between the switch and the monitoring server.
   • BEnsure that the firewall allows TCP port 22 for SSH, as ERSPAN uses SSH for encapsulation.
   • CEnsure that the firewall allows UDP port 53 for DNS, as ERSPAN uses DNS for encapsulation.
   • DEnsure that the firewall allows ICMP, as ERSPAN uses ICMP for encapsulation.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A network engineer needs to monitor traffic between two servers connected to the same access switch. The monitoring laptop is connected to a different port on the same switch. The engineer wants to capture all traffic between the two servers using Wireshark. What should the engineer do?

   • AConfigure an RSPAN session to mirror the traffic to a remote VLAN and then capture on the laptop.
   • BConfigure a SPAN session on the switch to mirror traffic from the two server ports to the monitoring port.
   • CPlug the laptop into one of the server ports using a hub to capture traffic.
   • DUse ERSPAN to encapsulate the mirrored traffic and send it to the laptop's IP address.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A network engineer needs to choose a packet capture method for a security investigation. The requirements are: capture traffic from a specific server port on a switch, send the traffic to a monitoring device on a different IP subnet, and minimize the impact on the switch's CPU. Which method should the engineer choose?

   • AUse tcpdump on the server to capture traffic and send the file to the monitoring device.
   • BConfigure ERSPAN on the switch to send encapsulated traffic to the monitoring device's IP address.
   • CConfigure RSPAN with a dedicated VLAN to carry the traffic to the monitoring device.
   • DConfigure local SPAN on the switch and connect the monitoring device to a port on the same switch.
   Reveal Solution Discussion Select an answer first