The apex is the top of your DNS zone, and it is where the SOA and NS records live. The DNS standard does not allow a CNAME to coexist with any other record at the same name, so a CNAME cannot be used at the apex.
This matters when a hosting platform or CDN tells you to "point your domain at our hostname". For www that is a simple CNAME. For the apex you either use A and AAAA records with the addresses the provider gives you, or use a DNS provider that offers ALIAS, ANAME or CNAME flattening, which follows the target behind the scenes and answers with addresses.
Whichever of example.com and www.example.com you prefer, make the other one redirect to it and make sure both have valid DNS records and are covered by the TLS certificate. Email addresses normally use the apex, so MX, SPF and DMARC records belong there too.
Example
example.com. 300 IN A 192.0.2.10 ; apex: address records
www.example.com. 300 IN CNAME example.com. ; subdomain: CNAME is fine