Which of the following devices is BEST suited to protect an HTTP-based application that is susceptible to injection attacks?

A protocol filter examines traffic at lower OSI layers based on protocol type and port numbers and cannot parse or inspect HTTP payload content for injection patterns.

A load balancer distributes incoming traffic across multiple servers to improve availability and performance but does not perform application-layer security inspection.

A Network Intrusion Detection System passively monitors and alerts on suspicious traffic patterns but does not actively block or filter malicious HTTP requests in real time.

A Layer 7 firewall operates at the application layer of the OSI model and can deeply inspect HTTP request and response content - including query strings, headers, and body data - to detect and block injection attacks such as SQL injection and cross-site scripting that exploit web application logic.