Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) — Question 166

What is the difference between inline traffic interrogation (TAPS) and traffic mirroring (SPAN)?

Answer options

• A. SPAN ports filter out physical layer errors, making some types of analyses more difficult, and TAPS receives all packets, including physical errors.
• B. TAPS replicates the traffic to preserve integrity, and SPAN modifies packets before sending them to other analysis tools.
• C. TAPS interrogation is more complex because traffic mirroring applies additional tags to data, and SPAN does not alter integrity and provides full visibility within full-duplex networks.
• D. SPAN results in more efficient traffic analysis, and TAPS is considerably slower due to latency caused by mirroring.

Correct answer: A

Explanation

The correct answer is A because TAPS captures all packets, including those with physical errors, while SPAN filters out certain errors, which can complicate analysis. Options B and C incorrectly characterize how TAPS and SPAN handle traffic integrity and tagging, while D misrepresents the efficiency and speed of TAPS in comparison to SPAN.