Exam 200-201 topic 1 question 160 discussion

C: In inline mode, the monitoring device is placed directly in the traffic path and actively participates in the flow of packets. It examines and potentially takes action on the traffic at wire speed. In tap mode, a network tap is used to passively capture a copy of the traffic as it traverses the network. The tap is typically placed on a network link, and the monitoring device receives a duplicate copy of the traffic. So, the key difference is that inline mode actively participates in the traffic path, while tap mode is a passive monitoring method that captures a copy of the traffic.

Inline mode and tap mode are two different methods of network traffic monitoring. Inline mode involves inserting a monitoring device, such as an Intrusion Prevention System (IPS), directly into the network traffic path. The monitoring device actively inspects all traffic passing through it, typically at wire speed, and can take action to block or allow specific traffic based on security policies. In contrast, tap mode involves using a network tap, which is a device that is inserted into the network without disrupting the normal flow of traffic. The tap makes a copy of the traffic and sends it to a monitoring device for analysis. This means that tap mode can capture traffic as it crosses the network, but at a potentially lower speed than inline mode. Therefore, the correct answer is C, as inline mode monitors traffic path, examining any traffic at a wire speed, while a tap mode monitors traffic as it crosses the network.

I think the answer should be "D"