How to Protect Business Applications from Data Exfiltration Attacks?

Core Defense Mechanism

The scenario explicitly mentions protecting a critical business application from data exfiltration attacks. In cybersecurity architecture, data exfiltration through web apps typically occurs via compromised APIs, SQL injection, or malicious form submissions. A Web Application Firewall (WAF) operates at Layer 7 (Application Layer) and is specifically engineered to inspect incoming and outgoing web traffic for malicious patterns, blocking exploit attempts before they reach the backend database or server.

Why Option B is Correct

As highlighted by multiple community experts, a WAF provides targeted, protocol-aware protection for web-facing applications. It utilizes signature-based detection, behavioral analysis, and rule sets (like OWASP CRS) to intercept and drop requests attempting to steal or leak sensitive data. This directly fulfills the requirement of preventing exploitation through common exfiltration vectors.

Why Other Options Are Incorrect

URL scanning (Option A) primarily analyzes links for malware or phishing indicators during browsing or email attachment inspection; it does not actively filter live application traffic. A reverse proxy (Option C) handles request routing, load balancing, and SSL termination, but lacks built-in intrusion prevention or payload inspection capabilities unless explicitly paired with a WAF module. NAC (Option D), often chosen due to its strong access control features, operates at Layers 2/3 to verify device posture and authenticate users before granting network connectivity. As noted in the community discussions, while NAC reduces unauthorized network access, it cannot see inside encrypted HTTPS streams or parse application logic to stop active data theft once a connection is established.