nerdexam
CompTIA

SK0-004 · Question #287

A new server was installed for the purpose of monitoring network traffic. The network has been configured in such a way that all traffic will be mirrored out the port this server is connected to…

The correct answer is C. NIC is not in promiscuous mode. A NIC in its default state only processes frames addressed to its own MAC address. To capture all traffic on a segment, the NIC must be placed in promiscuous mode.

Troubleshooting

Question

A new server was installed for the purpose of monitoring network traffic. The network has been configured in such a way that all traffic will be mirrored out the port this server is connected to. When reviewing the network traffic logs on the server only traffic destined to the server is listed in the logs. Which of the following is preventing the server from seeing all network traffic?

Options

  • ANIC filtering is enabled.
  • BPort security is configured.
  • CNIC is not in promiscuous mode.
  • DNIC is in promiscuous mode.

How the community answered

(37 responses)
  • A
    16% (6)
  • B
    11% (4)
  • C
    70% (26)
  • D
    3% (1)

Why each option

A NIC in its default state only processes frames addressed to its own MAC address. To capture all traffic on a segment, the NIC must be placed in promiscuous mode.

ANIC filtering is enabled.

NIC filtering is not a standard networking term in this context and does not describe the mechanism that controls whether a NIC processes all traffic on a segment.

BPort security is configured.

Port security is a switch feature that restricts which MAC addresses can communicate on a port and does not control whether a connected NIC processes all mirrored traffic.

CNIC is not in promiscuous mode.Correct

By default, a NIC discards frames not addressed to it, so the monitoring server only logs traffic destined to itself. Promiscuous mode instructs the NIC driver to pass all received frames up to the OS regardless of destination MAC address, which is required for packet capture and network traffic analysis tools to function correctly.

DNIC is in promiscuous mode.

If the NIC were already in promiscuous mode, the server would be seeing all mirrored traffic, which is the desired outcome, not the problem described.

Concept tested: NIC promiscuous mode for network traffic capture

Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/network-monitor-promiscuous-mode

Topics

#promiscuous mode#NIC#network monitoring#packet capture

Community Discussion

No community discussion yet for this question.

Full SK0-004 Practice