The correct answer is to configure a SPAN port on the switch, as this technique enables an investigator to perform port traffic capture forensics without altering the live network flow. A SPAN, or Switched Port Analyzer, creates a passive copy of all packets traversing a source port or VLAN and forwards them to a designated monitoring port, ensuring the forensic workstation receives the data without injecting any frames or disrupting switch forwarding behavior. On the Computer Hacking Forensic Investigator CHFI exam, this concept tests your understanding of non-intrusive evidence collection methods, often appearing in scenario-based questions where preserving network integrity is critical. A common trap is confusing SPAN with inline taps or ARP spoofing, which actively modify traffic; remember that SPAN is purely observational. Memory tip: SPAN stands for “See Packets, Alter Nothing.”
CHFI Network and Cloud Forensics Practice Question
This CHFI practice question tests your understanding of network and cloud forensics. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An investigator needs to capture network traffic from a live network segment without altering the traffic flow. Which technique should they use?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a SPAN port on the switch
A SPAN (Switched Port Analyzer) port, also known as a mirror port, copies all traffic from a specified source port or VLAN to a destination port where the forensic workstation is connected. This allows the investigator to capture traffic without injecting any frames or altering the forwarding behavior of the switch, thus preserving the integrity of the live network segment.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Enable NetFlow on the router and capture flows
Why it's wrong here
NetFlow provides traffic metadata, not full packet captures.
✓
Configure a SPAN port on the switch
Why this is correct
Port mirroring (SPAN) copies traffic to a monitor port without interrupting the original flow.
Related concept
Read the scenario before looking for a memorised answer.
✗
Deploy an ARP spoofing tool to redirect traffic
Why it's wrong here
ARP spoofing manipulates traffic, altering the flow and potentially causing disruption.
✗
Set the NIC to promiscuous mode on the forensic workstation
Why it's wrong here
Promiscuous mode alone does not capture traffic from other switch ports without a tap or mirror.
Common exam traps
Common exam trap: answer the scenario, not the keyword
EC-Council often tests the misconception that promiscuous mode alone is sufficient for capturing all traffic on a switched network, but candidates forget that switches isolate traffic per port unless a SPAN port is configured.
Detailed technical explanation
How to think about this question
When configuring a SPAN port, the switch uses hardware-based frame replication at the ASIC level to copy packets from the source port to the destination monitor port, ensuring zero impact on the original traffic path. In a real-world scenario, an investigator might use a remote SPAN (RSPAN) or Encapsulated Remote SPAN (ERSPAN) to capture traffic across multiple switches or over a routed network, but the local SPAN is the simplest and most reliable method for a single switch segment. A common subtlety is that SPAN ports typically drop frames that exceed the monitor port's bandwidth or are malformed, so the investigator must ensure the monitor port has sufficient capacity to avoid packet loss.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CHFI question in full detail.
Network and Cloud Forensics — This question tests Network and Cloud Forensics — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Configure a SPAN port on the switch — A SPAN (Switched Port Analyzer) port, also known as a mirror port, copies all traffic from a specified source port or VLAN to a destination port where the forensic workstation is connected. This allows the investigator to capture traffic without injecting any frames or altering the forwarding behavior of the switch, thus preserving the integrity of the live network segment.
What should I do if I get this CHFI question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.