A security team deploys a passive network intrusion detection sensor and needs it to receive a copy of all traffic passing through an access switch without affecting the flow of production traffic if the sensor fails. Which configuration BEST meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
Port mirroring is like a photocopier at the mailroom - the original letters keep moving, and the IDS gets copies to read. Put the sensor inline and you've made every packet walk through it; if it dies, so does the traffic. That's the trap.
Full Explanation
Port mirroring, often called a switched port analyzer (SPAN) session, instructs a switch to duplicate traffic from selected ports or VLANs to a designated monitoring port. A passive intrusion detection sensor attached to that port receives copies for analysis while production traffic continues along its normal path. If the sensor fails or is overloaded, production is unaffected, which matches the stated requirement. Placing the sensor inline makes every packet traverse it; that design suits an intrusion prevention system that must block traffic, but a failure or bottleneck in the sensor then affects production unless additional fail-open hardware is used. NetFlow export sends summarized conversation records rather than packets, so a detection engine that inspects packet contents would receive no payload to analyze. Making the sensor the default gateway forces traffic to route through it, which is effectively inline placement with even more disruption and adds a routing single point of failure. Exam caveat: heavily loaded mirrors can drop copied packets, so a dedicated network tap is sometimes preferred for complete capture. Operational check: generate a known test pattern on a mirrored port and confirm the sensor sees and alerts on it, then confirm production traffic is unaffected when the sensor is disconnected.