Answer – B and C
The AWS documentation mentions the following
You use AWS WAF to control how Amazon CloudFront or an Application Load Balancer responds to web requests. You start by creating conditions, rules, and web access control lists (web ACLs). You define your conditions, combine your conditions into rules, and combine the rules into a web ACL.
For more information on AWS WAF, please refer to the below URL:
http://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works.html