Which statement best describes an application layer firewall?

• A. Inspects traffic up to layer 7, including payload, enabling application-level criteria.
• B. Inspects traffic up to layer 3 only.
• C. Blocks all traffic by default.
• D. Inspects DNS queries only.

Answer: (A)

An application layer firewall operates by examining traffic all the way up to the application data (layer 7). This means it can interpret and enforce rules based on the actual application protocol and content, such as HTTP methods, URLs, headers, cookies, or specific payload patterns. Because it looks inside the traffic, it can allow or block traffic based on application behavior, not just on where it’s coming from or going to.

The other statements describe different filtering approaches. A firewall that only inspects up to layer 3 would ignore the actual content of the traffic and rely on IPs and ports alone. Blocking all traffic by default is a generic security posture, not a capability that defines an application layer firewall. Inspecting DNS queries only covers DNS filtering, which is separate from inspecting general application-layer protocols like HTTP, SMTP, or FTP.