An application needs protection against common HTTP attacks such as SQL injection and cross-site scripting. Which control directly addresses this Layer 7 requirement?

1. A NAT Gateway
2. A web application firewall with appropriate managed and custom rules
3. A private DNS zone
4. An NSG that only allows TCP 443