A supported internet-facing HTTP application needs application-edge filtering and protected backend access so clients cannot bypass the edge policy. Which two controls should the team combine? Select 2 answers.

1. Assume an edge policy replaces every application identity and resource permission check.
2. Leave the backend independently public because the frontend has a WAF.
3. Restrict backend access to the intended load-balancer or proxy path.
4. Apply an appropriate Cloud Armor policy to the supported frontend.
5. Use a billing budget as the HTTP request-authorization mechanism.