Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) — Question 125

What is a difference between data obtained from Tap and SPAN ports?

Answer options

• A. SPAN passively splits traffic between a network device and the network without altering it, while Tap alters response times.
• B. Tap mirrors existing traffic from specified ports, while SPAN presents more structured data for deeper analysis.
• C. SPAN improves the detection of media errors, while Tap provides direct access to traffic with lowered data visibility.
• D. Tap sends traffic from physical layers to the monitoring device, while SPAN provides a copy of network traffic from switch to destination.

Correct answer: D

Explanation

The correct answer is D because a Tap provides a direct copy of the traffic from the physical layer, allowing for complete visibility without impacting performance. In contrast, SPAN mirrors traffic from the switch to a destination port but may not capture all traffic types as effectively as a Tap, leading to potential data loss.