Which of the following method is specifically designed to allow a network analyst to monitor traffic?

Why this is correct:
Port mirroring (SPAN) is a switch feature that copies traffic from one or more switch ports or VLANs to a designated port where a monitoring device (packet capture/analysis tool) can observe the traffic — specifically designed for monitoring. Why the others are wrong: 1.      Forward chaining is an inference method in expert systems/AI, not network traffic monitoring. 2.      A firewall enforces access control and filters traffic; while it can log, it is not the specialized mechanism for passively capturing all traffic from a segment. 3.      “Switch monitoring” is a generic phrase — port mirroring is the concrete method used on switches for monitoring.