ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 767 - N10-008 discussion

Report
Export

A network security engineer is investigating a potentially malicious Insider on the network. The network security engineer would like to view all traffic coming from the user's PC to the switch without interrupting any traffic or having any downtime. Which of the following should the network security engineer do?

A.
Turn on port security.
Answers
A.
Turn on port security.
B.
Implement dynamic ARP inspection.
Answers
B.
Implement dynamic ARP inspection.
C.
Configure 802.1Q.
Answers
C.
Configure 802.1Q.
D.
Enable port mirroring.
Answers
D.
Enable port mirroring.
Suggested answer: D

Explanation:

Port mirroring is a feature that allows a network switch to copy the traffic from one or more ports to another port for monitoring purposes. Port mirroring can be used to analyze the network traffic from a specific source, destination, or protocol without affecting the normal operation of the network. Port mirroring can also help to detect and troubleshoot network problems, such as performance issues, security breaches, or policy violations.

The other options are not correct because they do not meet the requirements of the question. They are:

Turn on port security. Port security is a feature that restricts the number and type of devices that can connect to a switch port. Port security can help to prevent unauthorized access, MAC address spoofing, or MAC flooding attacks. However, port security does not allow the network security engineer to view the traffic from the user's PC to the switch.

Implement dynamic ARP inspection. Dynamic ARP inspection (DAI) is a feature that validates the ARP packets on a network and prevents ARP spoofing attacks. DAI can help to protect the network from man-in-the-middle, denial-of-service, or data interception attacks. However, DAI does not allow the network security engineer to view the traffic from the user's PC to the switch.

Configure 802.1Q. 802.1Q is a standard that defines how to create and manage virtual LANs (VLANs) on a network. VLANs can help to segment the network into logical groups based on function, security, or performance. However, 802.1Q does not allow the network security engineer to view the traffic from the user's PC to the switch.

Reference 1:Port Mirroring - an overview | ScienceDirect Topics 2:Network+ (Plus) Certification | CompTIA IT Certifications 3:Port Security - an overview | ScienceDirect Topics 4:Dynamic ARP Inspection - an overview | ScienceDirect Topics 5:802.1Q - an overview | ScienceDirect Topics

asked 02/10/2024
Péter Szittya
43 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first