A - Firewall filters the inbound and outbound connection, but not secure apps from malicious traffic, so IPS and WAF is the solution if firewall is already in place, but 1. NGFW filter the connections and apply the web filtering, antivirus checking, apps based access, etc based on license for services . & B. 4 WAF for inbound app security.
