A sensor must receive every frame on a busy 10-Gbps uplink, including frames with errors, with no risk of copies being dropped when the switch is under heavy load. Which method should feed the sensor?
Select an answer to reveal the explanation.
Short Explanation
A TAP is a physical splitter on the cable, so it copies everything the wire carries, flaws and all. SPAN is the switch doing you a favor when it has spare time. When the stem says every frame, even errored ones, under load, the switch-based options are the trap.
Full Explanation
A network TAP is a hardware device inserted into a link that copies the signal of both directions to monitoring ports. Because it operates at the physical layer and does not depend on switch resources, it forwards every frame, including malformed or errored frames, without being affected by switch CPU or buffer contention. That makes it the choice when completeness under load is a requirement. A local SPAN session asks the switch to replicate traffic to a destination port; switches typically give mirrored traffic lower priority, drop copies when the destination port is oversubscribed, and generally do not mirror frames that failed error checks, so completeness is not guaranteed. RSPAN carries mirrored traffic across a dedicated VLAN to a remote switch; it inherits the same limitations as SPAN and adds trunk bandwidth contention. A NetFlow exporter produces summary records of conversations, not copies of frames, so the sensor would receive no packets at all. Exam caveat: a full-duplex 10-Gbps link can carry up to 20 Gbps combined, so even a TAP requires a monitoring tool or aggregation that can absorb both directions. Operational check: compare the sensor's packet counts with the link's interface counters during peak load and confirm the two match within expected tolerance.