Which statement best describes SPAN's function?

• A. It blocks traffic on a mirrored port
• B. It aggregates all traffic onto a single port
• C. It forwards a copy of traffic from one or more ports to a monitoring destination
• D. It encrypts mirrored traffic

Answer: (C)

SPAN duplicates traffic from chosen switch ports and forwards a copy to a monitoring destination. The original traffic continues to its intended path, so nothing is blocked or altered for the endpoints. This behavior makes it ideal for capturing packets with a sniffer or IDS on the monitoring port. It’s not about aggregating all traffic into one port, nor about encrypting mirrored data; SPAN simply copies the selected traffic to a dedicated destination for analysis.