Application layer firewalls inspect protocol payloads and can detect and block SQL injection attacks by analyzing database queries in HTTP traffic. They cannot prevent non-technical social engineering or physical wireless attacks like war-dialing/driving.