A security team is deploying Cloud Native Application Firewall (CNAF) on a containerized web application. The application is running an NGINX container. The container is listening on port 8080 and is mapped to host port 80. Which port should the team specify in the CNAF rule to protect the application?

The Cloud Native Application Firewall (CNAF), now part of Web Application and API Security (WAAS), protects the application process itself. The security rule must be configured to monitor the port the application is actively listening on inside the container, which is port 8080. The host port (80) is part of the network mapping, but the application logic and vulnerabilities reside on the process bound to the container port.

A. 443: This port is for HTTPS traffic. The scenario does not mention TLS/SSL, and it is not the port the NGINX process is listening on.
B. 80: This is the host port that maps to the container. The WAAS rule must target the actual application port (8080) to inspect traffic destined for the NGINX process.
D. 8888: This port is arbitrary and not mentioned anywhere in the scenario.

1. Palo Alto Networks

Prisma Cloud Administrator's Guide (SaaS)

"Web Application and API Security (WAAS)". The documentation on creating a WAAS rule specifies that the user must define the "Listening port" for the application being protected. This refers to the port the application process is bound to.

2. Palo Alto Networks

Prisma Cloud Docs

"Add a WAAS Rule". Step 5 in the rule creation process is "Specify the listening port for your app". For a containerized application

this is the port exposed by the container (e.g.

EXPOSE 8080 in a Dockerfile)

not the host port it might be mapped to.