An information security administrator wishes to block peer-to-peer (P2P) traffic over Hypertext Transfer Protocol (HTTP) tunnels. Which of the following layers of the Open Systems Interconnection…

The Presentation layer (Layer 6) handles data formatting, encryption, and encoding translation, but does not process or inspect protocol-level traffic such as HTTP or P2P application behavior.

The Transport layer (Layer 4) manages TCP/UDP ports and connection management; P2P over HTTP tunnels uses standard port 80/443, so Transport-layer inspection cannot distinguish P2P traffic from normal web traffic.

The Session layer (Layer 5) manages session establishment and synchronization between applications but does not have visibility into the application-level payload needed to identify HTTP-tunneled P2P protocols.

The Application layer (Layer 7) is where HTTP operates, and P2P applications that tunnel their traffic over HTTP do so by embedding their protocol within HTTP requests and responses. Deep packet inspection (DPI) at this layer allows a security device to examine the actual content and behavior of HTTP traffic-beyond just ports and IP addresses-to identify P2P signatures and block them. Only at Layer 7 can the distinction between legitimate HTTP web traffic and HTTP-tunneled P2P traffic be made.