The correct answer is B. NGFW utilizing application inspection.
A next-generation firewall, or NGFW, can perform deep packet inspection and application-layer inspection. This allows it to identify the actual application or protocol being used, even when the traffic is running over a nonstandard port.
In this scenario, HTTP traffic is being sent over port 53. Port 53 is normally associated with DNS, so a traditional port-based firewall might allow or misclassify the traffic. An NGFW with application inspection could detect that the traffic is actually HTTP, not DNS, and block it according to policy.
Why the other options are incorrect:
A. WAF utilizing SSL decryption
A web application firewall protects web applications from web-based attacks. SSL decryption helps inspect encrypted HTTPS traffic, but this scenario is about detecting HTTP over an unusual port.
C. UTM utilizing a threat feed
A Unified Threat Management device can provide multiple security functions, and threat feeds can help identify known malicious indicators. However, the key control needed here is application inspection.
D. SD-WAN utilizing IPsec
SD-WAN manages WAN connectivity and routing, while IPsec provides encrypted tunnels. This does not identify or block HTTP being misused over port 53.
Therefore, the best answer is NGFW utilizing application inspection.
