A security team wants to collect full-content packet capture at multiple network choke points without impacting production traffic. The preferred method is passive monitoring. Which technology achieves this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because hardware network taps (passive or active) split the optical or electrical signal and pass a copy to monitoring systems without inserting any device in the traffic path, ensuring zero impact on production traffic. A is wrong because SNMP collects performance statistics (counters, utilization) but does not provide packet-level visibility.
Full explanation below image
Full Explanation
B is correct because hardware network taps (passive or active) split the optical or electrical signal and pass a copy to monitoring systems without inserting any device in the traffic path, ensuring zero impact on production traffic. A is wrong because SNMP collects performance statistics (counters, utilization) but does not provide packet-level visibility. C is wrong because sFlow provides statistical packet sampling (not full content) which misses most packets. D is wrong because NetFlow provides flow metadata (5-tuple, bytes, duration) but not full packet content.