A security team wants to collect full-content packet capture at multiple network choke points without impacting production traffic. The preferred method is passive monitoring. Which technology achieves this?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — installing network taps gives you passive monitoring because they split the optical or electrical signal and pass a copy to capture sensors without inserting anything into the production path. That means you get full-content packet capture with zero impact on production traffic.
Full Explanation
Installing network taps (optical or copper) on the monitored links, passing a copy of all traffic to capture sensors without any impact on the production link, is correct because hardware network taps (passive or active) split the optical or electrical signal and pass a copy to monitoring systems without inserting any device in the traffic path, ensuring zero impact on production traffic. Deploying SNMP agents on all switches to collect interface statistics is wrong because SNMP collects performance statistics (counters, utilization) but does not provide packet-level visibility. Configuring sFlow on all core routers for packet sampling is wrong because sFlow provides statistical packet sampling (not full content), which misses most packets. Enabling NetFlow v9 on all perimeter routers for flow export is wrong because NetFlow provides flow metadata (5-tuple, bytes, duration) but not full packet content.