A 911 PSAP analyzer sits beyond a Layer-3 core, and operators reject creating an RSPAN VLAN end-to-end across that routed boundary. Which choice correctly justifies ERSPAN instead?
Select an answer to reveal the explanation.
Short Explanation
RSPAN needs a continuous Layer-2 VLAN path for the mirror specialty lane. Hit a routed core with no end-to-end RSPAN VLAN and you need ERSPAN’s IP encapsulation instead.
Full Explanation
The 911 PSAP analyzer sits beyond a Layer-3 core, and operators reject building an RSPAN VLAN end-to-end across that routed boundary. ERSPAN is justified because mirrored traffic must traverse Layer-3; RSPAN depends on a continuous Layer-2 RSPAN VLAN path that a routed core does not provide. Encapsulating the mirror for IP delivery matches the topology without forcing an L2 VLAN across OSPF/EIGRP boundaries the PSAP team refuses to create.
Saying ERSPAN is required because local SPAN cannot mirror more than one VLAN fails by concept—the driver here is L3 reachability to the analyzer, not a fictional single-VLAN local-SPAN limit. Claiming ERSPAN replaces NetFlow exporters and cannot coexist with any flow monitor confuses metering with mirroring; both can exist for different assurance goals. Asserting RSPAN always works across OSPF domains without a continuous VLAN is incorrect: RSPAN needs L2 continuity for the RSPAN VLAN and does not ride OSPF alone.
Exam caveat: the deciding factor is path type—same switch (local SPAN), remote L2 (RSPAN), remote L3 (ERSPAN). Emergency/public-safety designs often place analyzers centrally across routed cores, which is a classic ERSPAN use case.
Operational check for the PSAP: confirm no continuous RSPAN VLAN exists across the L3 core, deploy ERSPAN to the analyzer IP, verify mirrored frames arrive, and ensure QoS/ACL policy does not drop the ERSPAN encapsulation on the path used for incident investigation.