* Server-Side Request Forgery (SSRF) occurs when an attacker manipulates a web server to make unauthorized internal or external requests, often to access internal resources or exfiltrate data.
* A Web Application Firewall (WAF) is the best mitigation because it:
* Filters and blocks malicious requests before they reach the server.
* Prevents attackers from sending unauthorized requests to internal services.
* Can detect and block SSRF patterns in incoming traffic.
Why Not Other Options?
* B (CASB) # Used for cloud access control, not effective against SSRF.
* C (Forward Proxy) # Helps with outbound traffic control, but SSRF involves incoming requests.
* D (MFA) # Helps with authentication but does NOT prevent SSRF attacks.
Reference: CompTIA CySA+ CS0-003, Chapter 6: " Application Security and Secure Coding, " Section: " Preventing SSRF and Web Exploits. "