What is a difference between data obtained from Tap and SPAN ports?

A Network Tap passively splits traffic directly from a physical link, providing an exact, unaltered mirror of all data, including errors. A SPAN (Switched Port Analyzer) port, configured on a network switch, creates a copy of traffic from selected source ports, which can be filtered or processed, potentially presenting a more 'structured' or targeted dataset to a monitoring device.

SPAN is an active switch feature, not a passive splitter, and it may alter traffic (e.g., dropping malformed frames). Network Taps are passive and do not alter traffic.

Taps generally provide more comprehensive traffic visibility, including physical layer errors, thus improving the detection of media errors compared to SPAN, which might filter out malformed packets.

While Taps operate at the physical layer and SPAN provides a copy, the statement for 'structured data' for SPAN and 'mirrors existing traffic' for Tap in option A refers to specific characteristics often compared.