A supported internet-facing HTTP application needs application-edge filtering and protected backend access so clients cannot bypass the edge policy. Which two controls should the team combine? Select 2 answers.

1. Leave the backend independently public because the frontend has a WAF.
2. Assume an edge policy replaces every application identity and resource permission check.
3. Apply an appropriate Cloud Armor policy to the supported frontend.
4. Restrict backend access to the intended load-balancer or proxy path.
5. Use a billing budget as the HTTP request-authorization mechanism.