A regional hospital has one spare FTD appliance and requires zero disruption to patient-monitor traffic, though its core router team can push ACL updates within minutes. Which SPAN-based passive deployment should the hospital build to keep the FTD out of the production data path?
Select an answer to reveal the explanation.
Short Explanation
You can keep the FTD out of the production path by using a SPAN session to send it a copy of the traffic, like a security camera watching without getting in the way. It can flag suspicious hosts, and your router team can block them with ACL updates.
Full Explanation
The SPAN-based design sends a copy of the patient-monitor segment to the FTD, so the appliance observes traffic without forwarding or modifying it. The FTD can identify suspicious hosts, and the router team can enforce the response with ACLs while leaving the sensor out of the production path. A network TAP can also send traffic to a passive FTD, and router ACLs can block flagged hosts, but a TAP is not the requested SPAN-based deployment. A SPAN-fed passive FTD with router ACL changes deferred to the next scheduled window also preserves passive monitoring, but delays mitigation despite the team’s ability to push updates within minutes. A SPAN-fed passive FTD paired with a separate fail-open inline IPS can detect and block threats, but it requires an additional enforcement appliance instead of using the available router-team response with the hospital’s spare FTD. Exam caveat: passive monitoring can detect and alert, but cannot itself drop mirrored packets; blocking must occur on an enforcement device in the traffic path. Practical check: verify the SPAN source and destination, confirm the FTD is in passive mode, and test that a router ACL blocks a flagged test host without affecting other patient-monitor traffic.