A CodePipeline runs: (1) CodeBuild compiles and runs unit tests, (2) CodeDeploy deploys to EC2 staging, (3) CodeDeploy deploys to EC2 production. QA wants to inspect the build artifact before production and run a manual penetration test that is invoked via a REST API. Which combination of changes should the DevOps engineer make? (Choose two.)

To allow QA to inspect the build artifact before production deployment, a manual approval action should be inserted into the CodePipeline. This pauses the pipeline, enabling QA to perform their checks. The approval action should be placed after the staging deployment and before the production deployment, ensuring the artifact is available for inspection in a deployed environment. For the manual penetration test invoked via a REST API, an AWS Lambda function is the most suitable integration method. The Lambda function can be configured to call the external REST API of the penetration testing tool. This allows the pipeline to trigger the test programmatically. Directly calling the REST API from the pipeline is not a native CodePipeline feature. Modifying the buildspec.yml for manual approval is incorrect because buildspec.yml controls the build process, not pipeline flow. CodeDeploy deployment groups do not inherently support manual approval for proceeding; pipeline-level approval is required.