A regional hospital must watch for exploit attempts on its clinical VLAN while patient-monitoring traffic stays completely unaffected, and the core switch's mirror session drops frames whenever nightly backups saturate the uplink. The team needs lossless copies of both directions of every conversation with the sensor out of the traffic path. Which passive deployment design satisfies all three requirements?
Select an answer to reveal the explanation.
Short Explanation
You’ll want a properly sized, full-duplex network TAP on the clinical segment, with your sensor listening passively out of the traffic path; it copies both directions without affecting patient-monitoring traffic. Like a wide enough drain for a busy pipe, its monitoring output must handle the copied load so backups don’t cause dropped frames.
Full Explanation
The correct design uses a full-duplex TAP to make copies of traffic in both directions without inserting the sensor into the clinical traffic path. Properly sizing the TAP and its monitoring output avoids the oversubscription problem described for the core switch mirror session, while passive monitoring prevents the sensor from forwarding, delaying, or blocking patient-monitoring packets. The SPAN-and-broker design is a common way to aggregate, filter, or replicate mirrored traffic, but the broker cannot recover frames the core switch fails to mirror when its session drops frames under backup load; retaining that switch as the source therefore fails the lossless-copy requirement. The one-direction capture design has an appropriate TAP and keeps the sensor passive, but deliberately omits server-to-client traffic, so it cannot provide both directions of every conversation. The fail-open inline design may inspect both directions and normally forward traffic unchanged, but the sensor remains in the clinical traffic path; fail-open behavior is not the same as out-of-band monitoring. Exam caveat: “passive” describes how a sensor operates, not necessarily whether the packet-copy source is reliable under congestion. Practical check: verify the TAP and monitor links can carry the aggregate full-duplex peak rate, and confirm with counters or a controlled test that both directions arrive without drops during backup load.