To protect applications from SQL injection attacks, which AWS service or feature should the company use?

AWS WAF (Web Application Firewall) is the correct choice because it helps protect web applications from common web exploits, including SQL injection attacks, by allowing you to configure rules that block malicious traffic patterns. Network ACLs and Security Groups operate at the network and instance level, respectively, controlling inbound and outbound traffic based on IP addresses, ports, and protocols, but they do not inspect the content of web requests for application-layer attacks like SQL injection. AWS Certificate Manager (ACM) is used for provisioning, managing, and deploying SSL/TLS certificates for securing network communications, not for preventing application-layer attacks.