Exam 200-201 topic 1 question 203 discussion

A is the correct answer SPAN ports ==> filter out physical layer errors, making some types of analyses more difficult, TAPS ==> receives all packets, including physical errors. Reference: https://insights.profitap.com/tap-vs-span

Answer is C

A is correct Tap is full duplex 1G. SPAN is not, also it is not passive and it drops packets and errors.

To begin with, SPAN ports are not adequate for full duplex 1G links. Even under circumstances that seem to fall below their maximum capacity, they can quickly become overburdened and drop packets. This can also happen because the switch prioritizes regular port-to-port date above SPAN port data. Unlike a network TAP, SPAN ports filter out physical layer errors, making some types of analyses more difficult, and as we have seen, incorrect delta times and altered frames can cause additional problems. TAPs, on the other hand, can run full duplex 1G links.

Option A is incorrect because both TAPS and SPAN capture all packets, including physical layer errors. The difference between the two lies in how they access the traffic. Option B is incorrect because SPAN does not modify packets before sending them to other analysis tools. It only copies the traffic and sends it to the destination port. Option D is incorrect because there is no evidence to suggest that SPAN is more efficient for traffic analysis than TAPS or that TAPS is considerably slower than SPAN.