ITPEC FE Morning April 2022 Question 43

Guard against misuse such as wiretapping — a LAN analyzer on a mirror port can display every packet copied to it.

A mirror port is a switch port set to receive a copy of the traffic passing through other ports. A LAN analyzer attached to it captures and decodes those packets, contents included, so passwords or personal data sent unencrypted become readable. The measurement must be controlled: authorized staff only, capture limited to what the investigation needs, and the analyzer and captured data kept secure.

Answer (c)

Why not others:

• •(a) — the analyzer is an administrator's tool; telling ordinary users where it is kept and how to use it invites exactly the misuse to be prevented
• •(b) — mirroring copies the traffic inside the switch, so no user's LAN cable has to be disconnected and the network keeps running during measurement
• •(d) — the analyzer receives copies and does not discard or alter the original packets, so other computers need not be restricted

Key rule: Passive monitoring does not disturb traffic but exposes its contents, so the risk to manage is who can see the captured data.

Security · AI-written, may contain errors