A company in France uses Amazon Cognito with the Hosted UI as an identity broker for sign-in and sign-up. The application’s users are expected to be in France, but after launch the security team observes fraudulent sign-ups, mostly from outside France. The team needs to perform custom validation during sign-up and accept or reject registrations based on the result. Which combination of actions will meet these requirements? (Choose two.)

The Pre Sign-up AWS Lambda trigger allows custom validation logic to be executed before a user is created in the Cognito user pool. This Lambda function can check the user's IP address or other attributes to determine if the sign-up should be allowed or denied, directly addressing the need to accept or reject registrations based on custom validation. AWS WAF can be associated with Amazon Cognito user pools to filter web requests. A geographic match rule statement in WAF can block sign-up requests originating from outside France, preventing fraudulent sign-ups from those regions. Configuring an app client and using its ID in the Hosted UI does not provide a mechanism for custom validation or geographic restriction. Amazon Cognito does not have a built-in geographic restriction setting for user pools. Configuring a social identity provider would delegate authentication to that provider but wouldn't inherently provide custom validation or geographic filtering for sign-ups within Cognito itself.