Which of the following preventative measures would BEST secure a web server from being port scanned by attackers publicly?

A content filter inspects and controls web content categories accessed by users but does not block network-level port scans.

A proxy server forwards client requests on behalf of users but does not inherently block inbound port scanning of a public web server.

An ACL with implicit allow would permit all traffic by default, which is the opposite of a secure posture and would not block port scans.

A firewall enforces rules that restrict which ports and protocols are accessible from external networks, preventing attackers from performing port scans against the server. By only allowing traffic on necessary ports (e.g., 80/443), all other probe packets are dropped before reaching the server. This is the standard perimeter defense for limiting the attack surface of public-facing systems.