The correct answer is D because the primary function of a web application firewall is to inspect, filter, and block malicious HTTP and HTTPS traffic directed at web applications. A WAF is specifically designed to protect web applications from attacks such as SQL injection, cross-site scripting, malicious requests, and protocol abuse. It operates at the application layer and evaluates web requests and responses based on rules, signatures, behavior, and application-specific policies. Automatically modifying its configuration may be a feature of some advanced adaptive tools, but it is not the main defining feature of a WAF. Restricting external traffic within a private network is more closely related to network firewalls or segmentation controls. Redirecting distributed denial-of-service attacks is usually handled by DDoS protection services, content delivery networks, or traffic scrubbing solutions. In CISM terms, the correct control must match the risk and technology layer being protected. Since a WAF protects web applications by filtering web traffic, option D is the best answer.