A company wants to protect internet-facing resources against volumetric DDoS while keeping web attack inspection. Which combination is most appropriate?

1. Use only encryption at rest for every public resource.
2. Disable all public health checks because they cause DDoS protection.
3. Use only WAF string matching as unlimited network-layer capacity.
4. Evaluate Shield protection for supported resources and retain WAF for HTTP-layer rules.