A WAF operates at the application layer (Layer 7) of the network stack, which enables it to provide more granular and context-aware security controls compared to traditional firewalls that work at lower network layers. It analyzes the application-specific traffic, looking for signs of malicious activity or abnormal behavior.