Which Two Settings Complete an ERSPAN Passive Interface in FMC?

Why the Answer Is Correct

Cisco's FMC device configuration documentation for interfaces states that, for ERSPAN interfaces, you must set the Flow ID to identify the ERSPAN traffic and the Source IP address of the ERSPAN traffic. Because the scenario already covers the passive interface itself and the ERSPAN IP address, the only two remaining required fields are Flow ID (D) and Source IP (E). These two values let the sensor recognize and correctly decapsulate the mirrored GRE stream arriving from the ERSPAN source switch or router. Without a Flow ID the sensor cannot distinguish this ERSPAN stream from other traffic, and without the Source IP it cannot validate the origin of the mirrored packets, so the configuration would be incomplete and the passive interface would not come up as intended. Selecting D and E therefore matches the vendor's own checklist exactly.

Why the Other Options Are Wrong

Destination MAC (A) is part of how a physical switch or router builds the ERSPAN frame on the network side, but FMC's ERSPAN passive interface dialog does not require you to enter one, so it does not complete the configuration described. TCP Intercept (B) is a legacy IOS denial-of-service protection feature and has nothing to do with defining an ERSPAN monitoring interface in FMC. Bypass Mode (C) is a hardware-bypass setting relevant to inline sets and inline interface pairs — a passive interface never sits in the forwarding path, so bypass is meaningless here. Only Flow ID and Source IP are the missing mandatory parameters, and the question explicitly asks for exactly two.

Community Comment Notes

Community consensus lines up with the vendor documentation rather than with any distractor. As gaprendizaje noted, the correct pair is D and E, and that commenter pointed directly at the FMC interfaces documentation containing the line "For ERSPAN interfaces, set…" the Flow ID and Source IP of the ERSPAN traffic. donciga confirmed the same pair and cited the Firepower Management Center 6.4 guide chapter on inline sets and passive interfaces for threat defense. The shared reasoning is that FMC's ERSPAN fields are deliberately minimal — passive interface, ERSPAN IP address, Flow ID and Source IP — which is exactly the four-item list the question is checking.

Exam Strategy Tip

Treat interface-configuration items as checklist-memorization questions: for each monitoring mode, recall the precise FMC fields. If an option sounds like it belongs to inline sets (bypass) or to another feature entirely (TCP Intercept), eliminate it before weighing the remaining candidates.