An engineer must deploy intrusion prevention so that malicious packets are dropped before they reach a server farm. The current sensor receives a copy of traffic from a switch SPAN session. What change achieves the requirement?
Select an answer to reveal the explanation.
Short Explanation
A security camera can record a burglar, but it can't lock the door. A sensor on a SPAN port is that camera; to stop packets you have to put the device in the doorway itself. Don't fall for tweaks to the copy; a copy can never be dropped on the real path.
Full Explanation
Intrusion detection and intrusion prevention differ in where the sensor sits. A sensor fed by SPAN or a TAP receives a duplicate of traffic; the original packets continue to their destination whether or not the sensor raises an alert, so it can only detect. An intrusion prevention system is placed inline, with traffic physically passing through it, typically as an inline pair or inline set of interfaces or as part of a routed or transparent firewall. Because each packet must be forwarded by the device, the IPS can discard packets that match a drop rule before they reach the servers. Adding SPAN bandwidth only improves visibility; the sensor still sees copies after the fact. Sending alerts to a SIEM for analyst review introduces human delay and acts after the malicious packets have been delivered. Moving the SPAN source changes which copy is taken, not whether the device can act on the original. Exam caveat: some passive sensors can send TCP resets, but that is unreliable and does not prevent the first packets, so it is not prevention. Operational check: after recabling inline, confirm the interfaces are in an inline set rather than tap or passive mode and that drop events appear in the intrusion events for a test signature.