A company has a single subnet in a small office. The administrator wants to limit non-web related traffic to the corporate intranet server as well as prevent abnormal HTTP requests and HTTP protocol…

A NIPS is a network-deployed sensor focused on detection and prevention at the network layer, not well suited for per-host traffic restriction in a single-subnet small office.

A HIDS is a detection tool, not a prevention mechanism for HTTP protocol anomalies, making this combination insufficient for blocking abnormal web requests.

ACLs and anti-virus do not provide HTTP protocol anomaly protection; anti-virus targets malware files rather than web application attacks, and ACLs lack application-layer HTTP inspection capability.

A host-based firewall installed on the intranet server enforces rules that allow only web-related ports such as 80 and 443 and blocks all other traffic types at the operating system level. A Web Application Firewall complements this by performing deep inspection of HTTP traffic to detect and block malformed requests, protocol violations, and attacks such as SQL injection. Together these two controls precisely address both stated requirements - traffic restriction and HTTP anomaly prevention.