A public HTTP application needs supported protection against injection and cross-site scripting patterns. Which control is directly relevant?

1. A larger VM memory size
2. A web application firewall with appropriate rules and tuning
3. A backup retention policy
4. An NSG allowing TCP 443 as complete HTTP payload inspection