A cloud deployment should replace a stored long-lived cloud key with GitHub Actions OIDC federation. Which two controls are essential to the intended design? Select 2.

1. Configure cloud trust conditions that restrict the expected audience and authorized repository/ref or environment identity.
2. Allow the deployment job to request an OIDC token using id-token: write.
3. Assume id-token: write grants administrator access in the cloud without any cloud-side configuration.
4. Store a permanent GitHub administrator PAT as the cloud role trust condition.
5. Accept tokens from any repository with any audience to avoid managing trust rules.