200-201 Question 256
Single answerA network administrator is tasked with monitoring traffic in a critical server environment without disrupting the flow of traffic. They need to analyze packets to detect potential threats but also ensure no latency is introduced to the live traffic. Which monitoring solution is most appropriate for this scenario?
- A
Using an inline traffic interrogation device to analyze packets in real-time
- B
Deploying a network tap to passively collect traffic for analysis
- C
Configuring a firewall to perform deep packet inspection on all network traffic
- D
Installing a packet capture tool directly on the critical server
Show answer and explanation
Correct answer: B
Explanation
Network taps are the most appropriate solution in this scenario because they allow passive traffic monitoring without introducing latency or impacting the flow of live traffic. Inline traffic interrogation devices and firewalls with deep packet inspection actively process traffic, which can disrupt the flow. Installing packet capture tools on the server can create unnecessary overhead and is not a passive monitoring solution.
- A. Incorrect.
Inline traffic interrogation devices analyze packets in real-time but introduce latency as they actively process traffic, making them unsuitable for environments where latency is a concern.
- B. Correct.
Network taps passively collect traffic without impacting live traffic flow, making them ideal for environments where uninterrupted traffic flow is critical.
- C. Incorrect.
Firewalls with deep packet inspection actively process traffic, which can introduce latency and affect traffic flow, making them less suitable for this scenario.
- D. Incorrect.
Installing a packet capture tool on the critical server can put an additional load on the server and does not provide a passive monitoring solution.