Your website utilizes EC2, S3, ELB-Classic, and CloudFront. Your manager has shifted focus to security and wants you to ensure the site is as secure as possible. What two items could you recommend? (Choose two.)

A. An NACL that blocks all ports to your subnets.
B. A restricted bucket policy.
C. A WAF on the load balancer.
D. A WAF on your CloudFront distribution.