A teaching hospital must detect attacks on a core switch segment that carries patient monitoring traffic. The switch supports port mirroring, spare appliance interfaces are available, and the team requires packets to keep flowing on time even if the appliance fails or a signature matches. Which NGIPS deployment design should the team implement for this segment?
Select an answer to reveal the explanation.
Short Explanation
A SPAN port sends a copy of your traffic to a passive sensor, which watches without controlling the flow. You’ll get attack alerts while patient monitoring traffic keeps flowing, even if the sensor fails or detects a signature match.
Full Explanation
A SPAN port sends a copy of the segment’s traffic to a passive sensor, which is not in the forwarding path. This lets the sensor detect and report attacks without delaying or dropping production packets if the appliance fails or a signature matches. By contrast, an inline set with fail-open can pass traffic when the appliance loses power, but while it is operating it can still block a packet that matches a signature, violating the requirement. Sending NetFlow records to a collector provides flow metadata rather than packet contents, so it cannot perform the packet-level inspection needed for payload-based signatures. Policy routing traffic through the sensor creates a forwarding dependency and permits enforcement, so a failure or match could affect timely delivery. A passive sensor detects and reports; it does not itself block traffic. One caveat is that an oversubscribed SPAN feed may omit packets, reducing detection coverage. Check the mirror configuration and capacity, then validate event generation with a safe test while confirming that forwarding continues.