A state university must add its first FTD sensor to the distribution switch uplink that carries registrar traffic. A third party owns the fiber plant, so every production cable must stay exactly as it is, yet the SOC still needs full payload inspection and alerts from day one. Which NGIPS deployment mode satisfies this constraint?

A passive FTD interface receiving a properly configured switch SPAN copy is appropriate because it inspects mirrored traffic without joining the production forwarding path, leaving the third party’s fiber and production cables unchanged. Configure the SPAN source to include the uplink in both directions, check that the switch can sustain the mirror rate, and enable the required inspection and alerting policy so the SOC can receive alerts from day one. A passive optical TAP can provide a full-duplex copy, but installing it on the uplink intervenes in the production fiber path and conflicts with the no-cable-change constraint. A passive FTD using a SPAN source limited to ingress traffic preserves cabling, but leaves out the reverse direction, so the sensor cannot inspect payloads it does not receive. A bidirectional SPAN session that delays SOC event forwarding until baseline validation provides the needed traffic copy, but postpones alerts and fails the day-one requirement. Exam caveat: “passive” describes the sensor’s relationship to the traffic path; it does not guarantee complete visibility, because SPAN direction, switch mirror capacity, and sensor interface settings matter. Practical check: verify bidirectional SPAN configuration and compare mirrored packet counts and drops with uplink traffic under representative peak load.