A proxy firewall operates at what layer of the Open System Interconnection (OSI) model?

The Transport layer (Layer 4) is associated with stateful packet inspection firewalls that filter based on TCP/UDP ports and connection state, not proxy firewalls that perform full application-layer content analysis.

The Data link layer (Layer 2) handles MAC addressing and frame switching, and no standard firewall type operates primarily at this layer for traffic filtering purposes.

The Network layer (Layer 3) is where packet-filtering firewalls operate, inspecting IP addresses and basic protocol headers, which lacks the application-awareness that defines a proxy firewall.

A proxy firewall operates at the Application layer (Layer 7) because it acts as an intermediary that fully understands application-layer protocols such as HTTP, FTP, and DNS. It terminates connections from clients, inspects the application-layer content for malicious payloads or policy violations, and then establishes a new connection to the destination, providing deep content inspection that lower-layer firewalls cannot perform.