The security team wants to protect a web application container from an SQLi attack. Which type of policy should the administrator create to protect the container?

Prisma Cloud’s Web-Application & API Security engine—formerly called the Cloud-Native Application Firewall (CNAF)—inspects HTTP/S traffic to containers and blocks layer-7 attacks such as SQL injection. Creating a CNAF (WAAS) policy is therefore the purpose-built control for SQLi protection on a containerised web application.

B. Runtime policies focus on process, file and network behavior inside running containers, not application-layer SQLi requests.
C. Compliance policies audit configuration and image contents; they do not provide active request inspection or blocking.
D. CNNF (Cloud-Native Network Firewall) enforces layer-3/4 network segmentation, not layer-7 web attack filtering.

1. Prisma Cloud Compute Edition Admin Guide v31, “WAAS (formerly CNAF) → Application Firewall → SQL Injection Protection” (docs.paloaltonetworks.com, Section ID: computewaassqlinjection).

2. Palo Alto Networks Tech Docs, “WAAS for Containers Overview” (2023-10-27), paragraph “Legacy product name: CNAF”.