Amazon CloudFront and AWS Shield are correct because they operate from AWS Edge locations to deliver content close to viewers and to provide integrated DDoS protection at the network edge.

Amazon CloudFront distributes and caches content across a global network of Edge locations so viewers receive data from nearby endpoints which reduces latency and improves streaming and download performance.

AWS Shield offers always on DDoS mitigation that integrates with the Edge network so attacks can be absorbed or mitigated before reaching the origin infrastructure and it is particularly effective when combined with CloudFront for traffic that flows through those Edge locations.

AWS Config operates at the regional level to record and evaluate resource configurations and it is not delivered from Edge locations so it does not provide edge content delivery or DDoS defense.

Amazon EBS is block storage provisioned within Availability Zones and it is not an edge service so it cannot reduce viewer latency by serving data from Edge locations.

AWS Direct Connect provides dedicated network links between customer sites and AWS Regions and it uses physical connection facilities rather than running services from CloudFront Edge locations so it is not considered an Edge location service.

Full AWS Practitioner Certification Question