A retail company hosts a public-facing web application in the cloud. After a security assessment, auditors flag that the application is vulnerable to SQL injection and cross-site scripting (XSS) attacks originating from the internet. The security team needs a control that inspects inbound HTTP/HTTPS traffic and blocks these application-layer exploits without requiring code changes to the application. Which control should the team deploy?