4.4 Compare Inline Traffic Interrogation and Taps or Traffic Monitoring 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a network TAP?

   • AA software agent installed on endpoints to collect logs.
   • BA device that is placed inline and can block malicious traffic.
   • CA device that duplicates traffic passing through a link and sends the copy to a monitoring tool.
   • DA router feature that forwards traffic to a different network.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst needs to capture full packet data on a 10 Gbps backbone link for a security investigation. The analyst must not impact the backbone traffic. Which method should be used?

   • AUse a passive optical tap to send a copy of the traffic to a capture appliance
   • BEnable SPAN on the switch and send traffic to a laptop
   • CConfigure the router to export NetFlow to a collector
   • DInsert an inline network intrusion prevention system (IPS)
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst needs to monitor traffic on a high-speed backbone link without introducing any additional latency. The monitoring solution must be able to capture full packets for incident response. Which solution should be selected?

   • ASPAN port on the switch
   • BNetFlow export
   • CPassive optical tap
   • DInline IPS with fail-open mode
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security operations center (SOC) wants to monitor traffic on a critical link for threat hunting without risking any disruption to the link. The SOC does not need to block traffic, only to detect and analyze. Which approach is most appropriate?

   • AUse a firewall's stateful inspection logs
   • BConfigure the router to block suspicious traffic and log it
   • CDeploy an inline IPS in fail-open mode
   • DUse a passive tap to send traffic to an IDS
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which statement correctly compares the visibility provided by inline and tap-based monitoring?

   • AInline devices have visibility into all traffic that passes through them, while taps provide a copy of traffic without affecting the original flow.
   • BBoth provide identical visibility because they both see all traffic.
   • CInline devices only see traffic that is destined to them, while taps see all traffic.
   • DInline devices see only the traffic that is forwarded to them, while taps see all traffic on the link.
   Reveal Solution Discussion Select an answer first