Attackers are targeting the citizen portal with HTTP application attacks such as injection and abusive web requests. Which control is the best fit for that threat layer?
Select an answer to reveal the explanation.
Short Explanation
Web app punches need a web app shield—that is the WAF’s lane. A plain port firewall does not speak HTTP injection. Mantraps protect doors, not form fields.
Full Explanation
HTTP application attacks such as injection and abusive web requests target the citizen portal's application layer. A web application firewall specializes in inspecting HTTP/S semantics—verbs, URLs, parameters, sessions, common exploit patterns—and applying allow/deny or virtual-patching rules appropriate to that threat layer. Layer-4 IP/port firewalls remain necessary for network zoning but lack application awareness for SQLi, XSS, or path abuse. Security+ maps application-layer web threats to WAF (and secure coding), not to physical mantraps or cleartext "inspection" by disabling HTTPS.
A traditional Layer 4 firewall rule that only allows or denies by IP and port cannot understand malicious payloads inside allowed 443 traffic. A physical mantrap at the datacenter entrance protects bodily access, not form-field injection over the Internet. Disabling HTTPS so inspectors can read cleartext more easily destroys confidentiality and integrity of citizen data and is not a legitimate application defense.
Exam caveat: match control to OSI/threat layer—web injection needs WAF/app security, not L4-only or physical controls. Operationally, place the WAF in front of the portal, tune rules to reduce false positives on legitimate citizen workflows, feed WAF blocks into the SIEM, keep TLS enabled, and remediate root causes in application code rather than relying on the WAF as the only permanent fix.