N10-009 Question 213
Single answerApplication programming interface (API) integration, Port mirroringA network administrator is integrating a cloud-based security monitoring platform with the company's on-premises network. The platform can ingest packet captures from a sensor and also accept alert data through a REST API. To investigate intermittent failed logins to an internal web application, the administrator connects a packet-analysis sensor to an access switch and wants the sensor to receive a copy of all traffic going to and from the application server without changing the server's IP configuration. Which action should the administrator take FIRST to ensure the sensor receives the necessary traffic for analysis?
- A
Configure port mirroring on the switch to copy the application server's switchport traffic to the sensor's switchport
- B
Create an API token on the web server so the sensor can pull raw packets directly from the application process
- C
Enable DHCP relay on the VLAN so the monitoring platform can collect login events through the API
- D
Assign the sensor the same IP address as the application server so it can inspect traffic inline
Show answer and explanation
Correct answer: A
Explanation
The best answer is to configure port mirroring on the switch. In real-world troubleshooting, a packet sensor needs a copy of traffic from the target server's port or VLAN. Port mirroring/SPAN is the standard switch feature used for this purpose and is commonly referenced in switch vendor documentation for traffic analysis, IDS/IPS monitoring, and protocol troubleshooting. API integration is relevant for sending metadata, alerts, or event information from tools into a monitoring platform, typically through RESTful methods using authentication tokens or keys, but API integration does not replace layer 2 packet visibility. Best practice is to use port mirroring for passive packet capture and use the API separately to forward analyzed events or alerts to the cloud security platform.
- A. Correct.
Correct. Port mirroring, also called SPAN on many switches, copies ingress and/or egress traffic from a source port or VLAN to a designated monitoring port. This allows a packet-analysis sensor to observe the application server's traffic without changing the server's addressing or inserting the sensor inline. In this scenario, that is the appropriate first step to capture packets for troubleshooting failed logins.
- B. Incorrect.
Incorrect. APIs are commonly used to exchange structured data such as alerts, logs, or configuration information, but they do not let a sensor pull raw Ethernet frames or switch-level packet copies from an application process. An API token may be useful for integrating alert data with the cloud platform, but it does not replace packet capture from the network.
- C. Incorrect.
Incorrect. DHCP relay forwards DHCP broadcast traffic between clients and a DHCP server on another subnet. It has no direct role in copying application traffic to a packet sensor or sending login events through a REST API. This option reflects confusion between IP helper functionality and monitoring integration.
- D. Incorrect.
Incorrect. Giving the sensor the same IP address as the server would create an IP conflict and disrupt communications. It also would not provide passive visibility into both directions of the server's traffic in a safe or supported way. Port mirroring is designed for passive monitoring without altering host addressing.