SY0-701 Question 200
Single answerFirewall types: Web application firewall (WAF) , Unified threat management (UTM) , Next-generation firewall (NGFW) , Layer 4/Layer 7A company hosts a customer-facing online ordering portal. After a recent code deployment, the security team observes repeated HTTP POST requests containing SQL metacharacters and script tags in form fields. The traffic is coming over TCP 443 from many different public IP addresses, and the application must remain publicly accessible. The team needs a control that can inspect web requests at the application layer and help block these attacks without replacing the existing perimeter firewall. Which solution is the BEST choice?
- A
Deploy a web application firewall (WAF) in front of the web application
- B
Replace the perimeter firewall with a Layer 4 packet-filtering firewall
- C
Implement a unified threat management (UTM) appliance as the only security control for the web tier
- D
Install a next-generation firewall (NGFW) configured only for IP/port-based allow and deny rules
Show answer and explanation
Correct answer: A
Explanation
The best answer is a web application firewall (WAF) because the scenario describes attacks embedded in legitimate web traffic to a public application: SQL injection and cross-site scripting indicators inside HTTP POST requests over HTTPS. Those are Layer 7 threats, so the control must inspect application-layer content rather than just source/destination IPs and ports. A WAF is purpose-built for this use case and is commonly deployed in front of public web applications to enforce rules for HTTP/HTTPS traffic, including protection against OWASP Top 10-style attacks such as injection and XSS. By contrast, Layer 4 firewalls make decisions using network and transport information and generally cannot evaluate web form fields or request payloads. NGFWs provide broader firewall capabilities, including deeper inspection and application awareness, but they are not automatically the best tool for dedicated web application attack mitigation, especially when configured only with basic port-based rules. UTM platforms consolidate multiple functions, but consolidation does not make them the best specialized control for this requirement. Relevant best-practice references include OWASP guidance on web application protections and vendor/industry documentation distinguishing application-layer WAF protections from traditional Layer 3/4 filtering and general-purpose firewalling.
- A. Correct.
Correct. A WAF is specifically designed to protect web applications by inspecting HTTP/HTTPS traffic at the application layer (Layer 7). It can identify and block common web attacks such as SQL injection and cross-site scripting by evaluating request methods, headers, cookies, URLs, and form parameters. In this scenario, the attack indicators are embedded in web requests, so a WAF is the most appropriate targeted control and can typically be added in front of the application without replacing the existing network firewall.
- B. Incorrect.
Incorrect. A Layer 4 firewall focuses primarily on transport/session characteristics such as IP addresses, ports, and protocols. Because the malicious payload is embedded inside otherwise legitimate HTTPS web requests over TCP 443, a Layer 4 device does not provide the application-layer inspection needed to detect SQL injection or script-tag-based attacks. This reflects the common misconception that port-based filtering is sufficient for web application threats.
- C. Incorrect.
Incorrect. A UTM appliance combines multiple security features into a single platform, which can be useful for small or branch environments. However, the question asks for the BEST control to inspect and block attacks directed specifically at a public web application without replacing the existing firewall. A generic UTM is not as specifically suited to web-application-layer protections as a dedicated WAF, especially for granular HTTP/HTTPS inspection and web attack mitigation.
- D. Incorrect.
Incorrect. An NGFW can provide advanced visibility and application awareness beyond traditional firewalls, and some models can inspect traffic more deeply than simple port-based devices. However, the option states it is configured only for IP/port-based allow and deny rules, which limits it to functionality more like a basic firewall policy. That configuration would not adequately address malicious input within allowed HTTPS sessions. The wording is designed to test whether the candidate notices the difference between NGFW capability and how it is actually configured.