II0-001 · Question #180
It is possible to place IDS in a switched environment effectively with the use of a Spanning Port
The correct answer is A. True. Placing an IDS in a switched network is effective when you leverage a Spanning Port (also called a SPAN port or mirror port) - a managed switch feature that copies all traffic from monitored ports to a designated monitoring port where the IDS sensor listens. Without this…
Question
It is possible to place IDS in a switched environment effectively with the use of a Spanning Port
Options
- ATrue
- BFalse
How the community answered
(64 responses)- A80% (51)
- B20% (13)
Explanation
Placing an IDS in a switched network is effective when you leverage a Spanning Port (also called a SPAN port or mirror port) - a managed switch feature that copies all traffic from monitored ports to a designated monitoring port where the IDS sensor listens. Without this, switches only forward traffic to its intended destination, meaning an IDS placed on an ordinary port would be blind to traffic not addressed to it. Option B is incorrect because it assumes switched environments inherently block effective IDS deployment, ignoring this well-established mitigation technique. Note that there is only one distractor here; the question is essentially testing whether you know that the switched environment problem is solvable, not an absolute barrier.
Memory tip: Think of SPAN as giving your IDS a "window seat" - it gets to see all the traffic flowing through the switch without being in the actual data path. If you remember "SPAN = visibility in switched networks," you'll lock in this concept for exam day.
Community Discussion
No community discussion yet for this question.