nerdexam
CompTIA

CS0-003 · Question #145

A company wants to configure the environment to allow passive network monitoring. To avoid disrupting the sensitive network, which of the following must be supported by the scanner's NIC to assist…

The correct answer is D. Port mirroring. To enable passive network monitoring without disrupting a sensitive network, the network infrastructure must support port mirroring to send a copy of network traffic to the scanner.

Submitted by zhang_li· Mar 6, 2026Security Operations

Question

A company wants to configure the environment to allow passive network monitoring. To avoid disrupting the sensitive network, which of the following must be supported by the scanner's NIC to assist with the company's request?

Options

  • APort bridging
  • BTunnel all mode
  • CFull-duplex mode
  • DPort mirroring
  • EPromiscuous mode

How the community answered

(31 responses)
  • B
    3% (1)
  • C
    3% (1)
  • D
    94% (29)

Why each option

To enable passive network monitoring without disrupting a sensitive network, the network infrastructure must support port mirroring to send a copy of network traffic to the scanner.

APort bridging

Port bridging connects two network segments at the data link layer, which is not primarily used for passive, non-disruptive monitoring of existing network traffic.

BTunnel all mode

Tunnel all mode is typically a VPN configuration where all network traffic is routed through an encrypted tunnel, which is unrelated to passive network monitoring.

CFull-duplex mode

Full-duplex mode allows simultaneous two-way communication on a network link, which is a standard operational mode for NICs and does not directly facilitate passive monitoring of all traffic.

DPort mirroringCorrect

Port mirroring, also known as SPAN (Switched Port Analyzer), is a network switch feature that duplicates network traffic from one or more source ports or VLANs to a designated destination port. This allows a monitoring device, such as a scanner, to passively analyze all traffic without interfering with the live network operations or requiring the scanner to be inline with the production traffic.

EPromiscuous mode

Promiscuous mode allows a NIC to capture all traffic it receives, regardless of the destination MAC address, but it still requires the traffic to be delivered to the NIC first, typically via port mirroring or a network TAP, to monitor traffic not addressed to it on a switched network.

Concept tested: Passive network monitoring with port mirroring

Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_25_see/configuration/guide/scg/swspan.html

Topics

#network monitoring#port mirroring#passive monitoring#network tap

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice