An internet-facing application uses CloudFront and an ALB. Security logs show repeated SQL injection and cross-site scripting attempts in HTTP requests. The company wants managed request filtering without changing application code. Which solution best addresses these attacks?

1. Configure a network ACL to search request bodies for SQL keywords.
2. Attach an AWS WAF web ACL with appropriate managed rule groups to CloudFront and tune rule actions for the application.
3. Enable only Shield Standard and assume it filters all SQL injection attempts.
4. Enable Amazon Inspector on the EC2 application instances and rely on vulnerability findings to block malicious HTTP requests.