According to the CHFI v11 Web Application Forensics and WAF module , the primary function of a Web Application Firewall (WAF) is to inspect, monitor, and filter HTTP/HTTPS traffic between a web application and its users. Unlike traditional network firewalls, which operate at the network or transport layer, WAFs function at the application layer (Layer 7) and are specifically designed to protect web applications from attacks such as SQL injection, Cross-Site Scripting (XSS), command injection, file inclusion, parameter tampering, and cookie poisoning .
WAFs such as ModSecurity analyze web requests and responses using rule-based logic, signatures, anomaly detection, and behavioral analysis . CHFI v11 emphasizes that WAF logs are critical forensic artifacts, as they record blocked requests, rule violations, payload details, source IP addresses, timestamps, and attack patterns. These logs allow investigators to detect, reconstruct, and attribute web-based attacks during forensic investigations.
The other options do not describe the primary function of a WAF. Encryption of web traffic is handled by SSL/TLS, not WAFs. DDoS protection is typically managed by network-level or cloud-based mitigation systems, although some WAFs may offer limited support. System log monitoring is the role of SIEM solutions, not WAFs.
Therefore, as defined in CHFI v11, the core purpose of a Web Application Firewall is inspecting and filtering HTTP traffic to protect web applications , making Option A the correct and verified answer.