Which next-generation firewall mode actively blocks flows traversing the firewall?

The correct answer is inline because an inline firewall is placed directly in the data path, allowing it to actively inspect and block traffic as it traverses the network. This deployment mode is essential for actively enforcing security policies and preventing threats. Tap mode (also known as sniffing orSPAN) involves sending a copy of the traffic to the firewall for analysis, but the firewall is not in the data path and cannot block traffic. Passive mode is similar to tap mode, where the firewall monitors traffic without actively interfering with it. Inline tap is not a standard, distinct operational mode for next-generation firewalls; it's a combination that doesn't represent an active blocking capability in the way "inline" does.