A company is deploying a stateless web application on EC2 instances in private subnets behind an Application Load Balancer (ALB). The web app instances run in an Auto Scaling group. A separate stateful management application runs on EC2 in another Auto Scaling group. The company wants to use the same URL, hostname, port, and protocol for both applications, with the management app accessible under the path prefix /management. Access to the management interface must be limited to the company's on-premises IP ranges. An ACM SSL/TLS certificate will protect the web app. Which two actions should a network engineer take to satisfy these requirements? (Choose two.)

The first correct action is to insert a rule for the ALB's HTTPS listener. This rule should use a path-pattern condition for /management and a source-IP condition for the on-premises IP ranges. If both conditions match, the request is forwarded to the management application's target group. Enabling stickiness on the management application target group is appropriate for stateful applications to maintain session affinity. The second correct action is to set the default rule for the ALB to forward all other requests (those not matching the /management rule) to the web application target group. Disabling stickiness for the web application's target group is correct because the web application is stateless. Incorrect options: Modifying the default rule to check for /management and source IP, then forwarding if not a match, is illogical for the management app. Using X-Forwarded-For for IP restriction is less secure and reliable than source-ip directly on the ALB. Modifying the default rule to forward to the web app if conditions don't match is partially correct but doesn't fully define the management app's rule. Forwarding all requests to the web app and disabling stickiness is incomplete as it doesn't address the management app.