Security has two schools of thought. One: "defend well inside" — validate input, parameterize queries, escape output at the application layer. The other: "filter early outside" — stop malicious traffic at the network edge before it reaches the application. Both matter. App defense alone and a DDoS kills the server instantly. Edge defense alone and sophisticated logic attacks get through. AWS's WAF, Shield, and ACM are three layers handling different threats at the network edge — WAF guards against L7 application attacks, Shield against L3/L4 DDoS, ACM against transport encryption.
In DVA-C02, these three appear as "which service for which threat?" questions. SQL injection → WAF