A company operates a web-based account management portal for an online game. Users sign in with a unique username and password. The portal is served by an Application Load Balancer protected by an AWS WAF web ACL that includes the AWS managed Core Rule Set (CRS). The security team detected a credential stuffing attack using credentials exposed in other breaches. The team must reduce the likelihood of successful credential stuffing while minimizing impact on legitimate users. Which combination of actions will meet these requirements? (Choose two.)

The AWS WAF Account Takeover Prevention (ATP) managed rule group is designed specifically to detect and mitigate credential stuffing attacks by identifying compromised credentials and suspicious login attempts, directly addressing the core problem. Configuring it to block requests labeled awswaf:managed:aws:atp:signal:credentialcompromised ensures that known compromised credentials are rejected, reducing successful credential stuffing. Creating a CloudWatch custom metric to analyze successful logins from a single IP provides visibility into potential credential stuffing patterns, allowing for proactive monitoring and further investigation or rule adjustments. Setting the web ACL default action to CAPTCHA for all users would significantly impact legitimate users, as every login attempt would require a CAPTCHA, which is not minimizing impact. Creating IP-based match rules to block IPs with many successful logins is reactive and less effective against distributed credential stuffing attacks, where attackers use many different IPs. Returning a custom block response that redirects to a password reset workflow doesn't prevent the initial credential stuffing attempt and could be disruptive to legitimate users who are not compromised.