An inline security device is placed directly in the path of the network traffic. It has the ability to actively block, permit, or modify the traffic passing through it based on the security policies in place, similar to how a checkpoint can stop or allow traffic in a roadway. In contrast, a tap (test access point) or monitoring device connects to a network segment but does not directly interact with the traffic flow; it merely duplicates the data for analysis, thus incapable of affecting the original traffic.