NSE 6 – FortiSwitch 7.2 — Question 43

Which statement about the use of the switch port analyzer (SPAN) packet capture method is true?

Answer options

• A. Traffic on the management interface can be mirrored and captured by the monitoring device.
• B. The monitoring device must be connected to the same switch where the traffic is being mirrored.
• C. SPAN can be configured only on a standalone FortiSwitch.
• D. Mirrored traffic can be sent across multiple switches.

Correct answer: B

Explanation

The correct answer is B because SPAN requires the monitoring device to be directly connected to the switch that is mirroring the traffic in order to capture it effectively. Option A is incorrect as not all traffic types, such as management interface traffic, can be mirrored. Option C is false since SPAN can be configured on various types of switches, not just standalone FortiSwitches. Option D is also incorrect because mirrored traffic is typically confined to the same switch unless additional configurations such as RSPAN are used.