A network TAP (Test Access Point) is a hardware device designed to create an exact, full-fidelity copy of network traffic for monitoring and packet analysis. TAPs operate at the physical layer and replicate all packets—including errors and malformed frames—without dropping traffic.

This makes TAPs ideal for packet sniffing, intrusion detection, and forensic analysis where accuracy and completeness are critical. TAPs do not rely on switch resources and do not introduce packet loss during periods of high traffic.

SPAN (mirror) ports can also copy traffic but are dependent on switch processing capacity and may drop packets during congestion, making them unreliable for full-fidelity capture. NAT modifies traffic, and tunneling encapsulates data rather than copying it.

Cybersecurity operations documentation consistently identifies TAPs as the preferred solution when exact traffic replication is required.

Therefore, the correct answer is tap.