Exam 350-401 topic 1 question 494 discussion

Now to remember this question... which answers filters? ... The only answer with the filter keyword of course....

This command will filter the captured traffic on interface GigabitEthernet1 to include only traffic with a source IP address "10.10.10.1/32"

B is correct

No wildcard mask is applied to the access list... And no "Host" keyword...

Answer B is the correct answer, it is the only item there doing any filtering. But the environment doesn't make sense. Gi1 is already the source and it is a layer 3 interface, so no filtering is needed. As a matter of fact, since you're filtering packets based on a unicast IP, you'll be losing packets that may come through G1 such as broadcast, multicast, etc. and that's really not what was asked.

Now I’m reading this: Only ACL name is supported to associate to the ERSPAN source session. If the ACL does not exist or if there is no entry defined in the access control list, the ACL name is not attached to the ERSPAN source session.

Correct Answer is B: From Cisco IOS XE Everest 16.4.1 release, ERSPAN has been enhanced to better monitor packets and reduce network traffic. This enhancement supports ACL on ERSPAN source session to filter only specific IP traffic according to the ACL, and is supported on the IOS XE platform. Both IPv4 and IPv6 traffic can be monitored by associating an ACL with the ERSPAN session. The ERSPAN session can associate only one IP ACL entry with its name. Thank you @Rose66

provided answer is correct... see https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/lanswitch/configuration/xe-16/lanswitch-xe-16-book/lnsw-conf-erspan.html