A firewall engineer is managing a Palo Alto Networks NGFW which is not in line of any DHCP traffic. Which interface mode can the engineer use to generate Enhanced Application logs (EALs) for classifyi

Virtual wire mode is an inline mode that bridges two interfaces, making the firewall part of the data path, which conflicts with 'not in line'.

Layer 3 mode involves IP routing and requires the firewall to be an active participant in the network path, making it an inline device.

Layer 2 mode operates as a transparent switch, also placing the firewall inline with the traffic flow, which is contrary to the requirement of 'not in line'.

A Tap interface operates in a passive listening mode, connected to a mirror or SPAN port, allowing the firewall to observe all network traffic, including broadcast DHCP, without being inline. This enables the firewall to generate Enhanced Application Logs (EALs) and classify IoT devices based on observed traffic without impacting network flow.