A company hosts an internal web application on EC2 instances in a private subnet behind a Network Load Balancer (NLB). The instances are in an Auto Scaling group and the application is accessed via a VPN to the on-premises network. After a SQL injection incident, a network engineer must implement controls to prevent SQL injection attacks going forward. Which combination of actions will address this? (Choose three.)

To prevent SQL injection attacks, an AWS WAF web ACL with SQL injection rules is essential. Network Load Balancers (NLBs) operate at Layer 4 (transport layer) and do not support integration with AWS WAF. Application Load Balancers (ALBs), however, operate at Layer 7 (application layer) and can integrate directly with AWS WAF. Therefore, replacing the NLB with an ALB is necessary to enable WAF protection. Once the ALB is in place, the AWS WAF web ACL must be associated with it to filter incoming traffic for SQL injection patterns before it reaches the EC2 instances. Creating a CloudFront distribution is not directly relevant for an internal application accessed via VPN, as CloudFront is a global CDN for public-facing content delivery. Associating WAF with CloudFront would be appropriate for public web applications, but not for this scenario. Associating WAF with an NLB is not possible due to their differing operational layers.