A network security engineer is investigating a potentially malicious insider on the network. The network security engineer would like to view all traffic coming from the user's PC to the switch without interrupting any traffic or having any downtime. Which of the following should the network security engineer do?
To view all traffic coming from the user's PC to the switch without interrupting any traffic or having any downtime, the network security engineer should enable port mirroring. Port mirroring creates a copy of the network traffic seen on one switch port to another port, allowing for traffic analysis without affecting network performance.
By enabling Port Mirroring, the traffic from the user's PC can be mirrored to another port on the switch where the network security engineer can capture and analyze the traffic.
Just had this question in my exam today and picked D