Wayfair Interview Question

Talk about XSS? What is WAF and how should it be implemented? Why would you use Metasploit?