Answer: A and C
Option A is CORRECT because AWS WAF can be deployed on Amazon CloudFront. As part of Amazon CloudFront, it can be part of your Content Distribution Network (CDN), protecting your resources and content at the Edge locations.
Options B is incorrect because, by default, AWS lambda is not integrated with AWS WAF. You can still use AWS WAF to automate security using AWS Lambda, which can analyze web logs, identify malicious requests, and automatically update security rules.
Option C is CORRECT because AWS WAF can be deployed on Application Load Balancer (ALB). As a part of the Application Load Balancer, it can protect your origin web servers running behind the ALBs.
Option D is incorrect because natively AWS WAF integrated with Application Load Balancer and not with a Classic load balancer.
For more information on the web application firewall, kindly refer to the below URLs:
https://aws.amazon.com/waf/faq/
https://aws.amazon.com/waf/preconfiguredrules/#:~:text=One%20of%20the%20ways%20in,and%20automatically%20update%20security%20rules.