N10-009 Question 214
Single answerApplication programming interface (API) integration, Port mirroringA network administrator is integrating a cloud-based monitoring platform with an on-premises IDS. The monitoring platform uses an API to pull alerts and device status from the IDS, while the IDS must inspect traffic from a critical application server connected to a managed switch. The administrator wants to capture the server's traffic for analysis without changing the server's IP configuration or interrupting production traffic. Which action should the administrator take FIRST to meet this requirement?
- A
Configure port mirroring on the switch to copy the application server's traffic to the IDS monitoring interface, then use the monitoring platform's documented API endpoints to collect IDS alerts
- B
Assign the IDS the same IP address as the application server so it can see all inbound and outbound traffic directly, then authenticate the monitoring platform with SNMP
- C
Create a site-to-site VPN between the monitoring platform and the switch so the platform can inspect raw packets from the application server without using the IDS
- D
Enable DHCP relay on the switch so the IDS receives a copy of the application server's traffic, then have the monitoring platform poll the IDS with ICMP
Show answer and explanation
Correct answer: A
Explanation
The best first step is to configure port mirroring on the managed switch so the IDS can passively inspect traffic from the critical application server. Port mirroring is a standard method for sending a copy of traffic from a source port or VLAN to a destination monitoring port without changing endpoint addressing or inserting a device inline. After the IDS analyzes mirrored traffic and generates events, the cloud-based monitoring platform should use the IDS's documented API for structured integration, such as retrieving alerts, device status, and health information. This aligns with common vendor guidance for IDS deployment and API-based integration: use switch-based traffic replication for passive visibility and use supported REST or similar APIs for software-to-software data exchange, rather than relying on unrelated protocols like DHCP relay or ICMP. SNMP may complement monitoring in some environments, but it does not replace an application API when the requirement is to pull alert and status data from a security platform.
- A. Correct.
Correct. Port mirroring, often called SPAN on many managed switches, is the appropriate way to copy traffic from a production switch port or VLAN to a monitoring device such as an IDS without changing the server's IP settings or placing the IDS inline. Once the IDS is receiving mirrored traffic and generating alerts, a cloud monitoring platform can integrate with it by using the IDS vendor's documented API endpoints for alerts, health, and status data. This matches the requirement to inspect traffic non-disruptively and use API integration for monitoring.
- B. Incorrect.
Incorrect. Assigning the IDS the same IP address as the server would cause an IP conflict and would not provide passive packet visibility. It could disrupt production traffic rather than preserve it. In addition, SNMP is commonly used for device monitoring and statistics, but it is not the same as using an API to pull structured alert data from a modern IDS platform.
- C. Incorrect.
Incorrect. A site-to-site VPN can securely connect networks, but it does not make a switch send a copy of a local server's packets to a cloud tool for packet inspection. The requirement is for the on-premises IDS to inspect the traffic, and the monitoring platform is only pulling alerts and status through an API. Bypassing the IDS would not meet the stated design.
- D. Incorrect.
Incorrect. DHCP relay forwards DHCP requests between subnets and DHCP servers; it does not replicate arbitrary application traffic to an IDS. ICMP polling can test reachability, but it does not retrieve IDS alert details the way an API does. This option combines two technologies that do not solve the packet capture and integration requirements.