ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

To satisfy the requirement that all external traffic be inspected before it reaches the web servers, the vWAF must sit transparently in the traffic path between the Internet edge and the web-tier network. Deploying the appliance as a two-arm, layer-2 bridge (sometimes called transparent or bump-in-the-wire mode) on the distributed virtual switch places it directly inline. Because it operates at layer 2, it forwards frames without acting as the default gateway, so server IP addresses and routing tables remain unchanged.

A passive SPAN/mirror port lets the vWAF see packets but not block them. Installing the vWAF on the hypervisor management network or as agents inside each web server would either miss traffic before it reaches the server or change the security model, violating the requirement for centralized, inline inspection.