ネットワーク セキュリティ エンジニアは、ネットワーク上の潜在的に悪意のある内部関係者を調査しています。ネットワーク セキュリティ エンジニアは、トラフィックを中断したりダウンタイムを発生させたりすることなく、ユーザーの PC からスイッチに送信されるすべてのトラフィックを表示したいと考えています。ネットワーク セキュリティ エンジニアが行うべきことは次のうちどれですか?
正解:D
Port mirroring is a feature that allows a network switch to copy the traffic from one or more ports to another port for monitoring purposes. Port mirroring can be used to analyze the network traffic from a specific source, destination, or protocol without affecting the normal operation of the network. Port mirroring can also help to detect and troubleshoot network problems, such as performance issues, security breaches, or policy violations.
The other options are not correct because they do not meet the requirements of the question. They are:
* Turn on port security. Port security is a feature that restricts the number and type of devices that can connect to a switch port. Port security can help to prevent unauthorized access, MAC address spoofing, or MAC flooding attacks. However, port security does not allow the network security engineer to view the traffic from the user's PC to the switch.
* Implement dynamic ARP inspection. Dynamic ARP inspection (DAI) is a feature that validates the ARP packets on a network and prevents ARP spoofing attacks. DAI can help to protect the network from man-in-the-middle, denial-of-service, or data interception attacks. However, DAI does not allow the network security engineer to view the traffic from the user's PC to the switch.
* Configure 802.1Q. 802.1Q is a standard that defines how to create and manage virtual LANs (VLANs) on a network. VLANs can help to segment the network into logical groups based on function, security, or performance. However, 802.1Q does not allow the network security engineer to view the traffic from the user's PC to the switch.
References1: Port Mirroring - an overview | ScienceDirect Topics2: Network+ (Plus) Certification | CompTIA IT Certifications3: Port Security - an overview | ScienceDirect Topics4: Dynamic ARP Inspection - an overview | ScienceDirect Topics5: 802.1Q - an overview | ScienceDirect Topics