Which option is best to use to capture only a subset of traffic (capturing traffic per-IP-address, per-protocol, or per-application) off the switch backplane and copy it
to the Cisco IPS appliance?

A.
SPAN

B.
PBR

C.
VACL

D.
MPF

E.
STP

Explanation:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/g uide/vacl.html#wp1037197