An IDS in a research lab must see a copy of one server's traffic without sitting inline. The switch can copy that server's frames to the sensor port. Which feature should be used?
Select an answer to reveal the explanation.
Short Explanation
You want a carbon copy of the mail, not a desk planted in the middle of the hallway. Port mirroring tells the switch to copy that server's frames to the port where the IDS listens, and the IDS never sits inline. An inline sensor would see the traffic by becoming part of the path, which is what the lab refused.
Full Explanation
Port mirroring copies frames from a chosen source port to a destination port. The IDS connects there and sees a copy while the original frames stay on their normal path. The sensor is not inline, so a sensor failure does not drop the server's traffic. An inline sensor is the near miss, because an IDS does need to see the packets, and the stem says it must not sit on the forwarding path. Flow records summarize who talked to whom and how many bytes moved. They are monitoring data, and they are not a copy of the frames. A physical tap can also present a copy by inserting hardware into the cable. The stem says the switch itself can copy frames, so the break is unnecessary. Exam caveat: on a busy link the switch can drop mirrored frames when the destination cannot keep up. A missed frame on the sensor is not proof the server never sent it. Operational check: configure the server's port as the mirror source and the IDS port as the destination, generate a known connection, and confirm it appears on the sensor while the server's path stays up.