Which scenario is best suited for passive traffic monitoring using a TAP?

A security analyst wants to analyze network traffic without any risk of disrupting the production network.

A device that must terminate SSL connections to inspect encrypted traffic.

A firewall that needs to block traffic based on application signatures.

A network intrusion prevention system (IPS) that must drop malicious packets.

In which scenario is inline traffic interrogation most appropriate?

When the goal is to analyze traffic patterns without any risk of impacting network performance.

When the organization needs to actively block malicious traffic in real time.

When the organization only needs to capture traffic for forensic analysis after an incident.

When the network must remain operational even if the monitoring device fails.

A security policy requires that all traffic to a specific subnet be denied, and the denial must be enforced in real time. Which technology should be deployed?

Flow collector with a block rule

SPAN port with a protocol analyzer

A security analyst needs to perform a forensic analysis of network traffic without introducing any risk of disrupting the production network. The monitoring solution must not alter the traffic flow. Which deployment should be used?

Next-generation firewall with SSL inspection

Inline intrusion prevention system (IPS)

Network tap connected to a passive monitoring appliance

Router configured with policy-based routing to a security appliance

A security engineer needs to inspect encrypted traffic to detect malware. The solution must be able to decrypt, inspect, and re-encrypt traffic. Which approach is most appropriate?

Flow collector with TLS metadata

Passive tap with a packet capture tool

CiscoCertified CyberOps Associate

Domain 4Objective 4

4.4 Compare Inline Traffic Interrogation and Taps or Traffic Monitoring 200-201 Practice Questions (Page 3)

Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

5concepts

20%of the exam

Questions 11–15

11foundation · easy
Which scenario is best suited for passive traffic monitoring using a TAP?
Select an answer first
12foundation · easy
In which scenario is inline traffic interrogation most appropriate?
Select an answer first
13application · medium
A security policy requires that all traffic to a specific subnet be denied, and the denial must be enforced in real time. Which technology should be deployed?
Select an answer first
14application · medium
A security analyst needs to perform a forensic analysis of network traffic without introducing any risk of disrupting the production network. The monitoring solution must not alter the traffic flow. Which deployment should be used?
Select an answer first
15application · medium
A security engineer needs to inspect encrypted traffic to detect malware. The solution must be able to decrypt, inspect, and re-encrypt traffic. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.