A public web application needs protection against common SQL injection and cross-site scripting patterns. Which control directly inspects these request characteristics?

1. Route 53 DNSSEC signing alone.
2. A network ACL permitting ephemeral ports.
3. AWS WAF rules associated with the supported application front door.
4. A security group allowing TCP 443 from every source.