Which statement best describes SPAN-related traffic behavior in the context of network analysis?

• A. To redirect traffic to attacker’s computer
• B. To disable STP on the network
• C. To mirror traffic for analysis by sending copies to a monitored device
• D. To modify VLAN tags

Answer: (C)

SPAN is about duplicating traffic for analysis by sending copies to a monitoring device. This lets a network analyzer, IDS, or similar tool observe what’s happening on the network without altering the original flow of frames. The mirrored copy travels to the designated monitoring port while the original frames still reach their intended destinations, so network behavior isn’t redirected to someone’s computer.

Because of that, SPAN isn’t about steering traffic toward an attacker, nor does it disable Spanning Tree Protocol. It also doesn’t modify VLAN tags on the traffic being observed—the copy is sent to the monitoring device as it appears on the source, preserving its headers for accurate analysis.