Tap mode (Inline Pair in Tap mode) allows the Cisco Secure Firewall Threat Defense appliance to be physically inline while still operating logically in passive mode, enabling the engineer to analyze and tune intrusion events without affecting live traffic. This is ideal for pre-deployment validation.