An organization wants centrally managed WAF policies across member-account ALBs with detection of resources missing protection. Which service best fits?

1. CloudFront cache invalidations scheduled for every account.
2. A security group in the management account attached automatically to every ALB worldwide.
3. AWS Firewall Manager with an organizational policy and the required prerequisites.
4. Route 53 weighted routing with equal weights.