A company is planning to host an application that will consist of the following layers.
A set of EC2 Instances hosting the web layer.
A database set on an RDS Instance.
S3 static websites that have global customers.
You need to ensure that you use the AWS WAF service as a defensive firewall against your system. Which of the following would you need to have to ensure this integration is possible? Choose 2 answers from the options given below.
 

Answer options:

A.Place an Application Load Balancer in front of the EC2 Instances.
B.Place a Network Load Balancer in front of the EC2 Instances.
C.Place a Cloudfront distribution to serve the contents in the S3 bucket.
D.Place a Cloudfront distribution in front of the database instance.

Answer – A and C
This is mentioned in the AWS Documentation.
AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to Amazon CloudFront or an Application Load Balancer. AWS WAF also lets you control access to your content. Based on conditions that you specify, such as the IP addresses that requests originate from or the values of query strings, CloudFront or an Application Load Balancer responds to requests either with the requested content or with an HTTP 403 status code (Forbidden). You also can configure CloudFront to return a custom error page when a request is blocked.
Option B is invalid because the WAF service supports the Application Load Balancer.
Option D is invalid because the CloudFront distribution should be placed in front of the S3 static websites.
For more information on Web Application Firewall, please visit the below URL
https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html