A WAF is designed to protect websites against code injections, malicious intrusions etc, basically hackers trying to infiltrate the application. Occasionally such a hack comes with DDoS.So basically a WAF has more specific functions up to layer 7 than only DDoS on layer 3…
This depends on the supplier. Most of the well known cloud suppliers know how to do security. Best to be aware of the human factor. Things like accounts take over. To prevent account takeovers a two factor identification would help a lot.