A company must apply managed web attack protections to an internet-facing ALB while preserving application-layer inspection. Which control is appropriate?

1. Use only a network ACL to match SQL injection strings in request bodies.
2. Use only an NLB security group to parse application JSON fields.
3. Associate an AWS WAF web ACL with the ALB and tune managed rules against observed traffic.
4. Use Route 53 health checks to block every malicious HTTP payload.