At a regional hospital, maintenance windows are unavailable for two quarters and facilities will approve only a switch mirror feed. The security team still needs months of exploit and file events from both server-to-server and internet traffic before enforcement. Which deployment mode should the engineer implement for this visibility phase?
Select an answer to reveal the explanation.
Short Explanation
Good call—you keep the sensor out of the production path while covering both server-to-server and internet traffic. Passive mode is the observation deck: it lets you see traffic on the monitored segments without standing in the doorway. Using only the edge mirror would miss the server-to-server traffic your team needs.
Full Explanation
A passive deployment on both core and edge switch mirrors fits the approved change boundary: the appliance receives traffic copies without entering the production path, so it can observe server-to-server and internet flows without a maintenance window. Keeping it in visibility mode also lets your team collect exploit and file events over the requested pre-enforcement period. Metadata-only parsing may seem like a way to limit retained data, but it omits the payload inspection needed to generate file events, so it does not provide the requested coverage. A 30-day event-retention policy can support a short baseline, but it cannot preserve the requested months of events for later analysis. Sampling both mirror feeds can reduce mirror-port load, yet it may omit exploit activity or file transfers the team needs to observe; sampled results are not equivalent to visibility across the traffic. Exam caveat: passive inspection avoids inline availability risk, but it does not guarantee complete capture or detection, especially on busy mirror ports. Practical check: verify that both mirror sessions include the required VLANs and traffic directions, confirm packet-drop counters remain acceptable under peak load, and test that exploit and file events are generated and retained for the intended period.