A company runs a public serverless application using Amazon API Gateway and AWS Lambda. Traffic recently spiked because of fraudulent botnet requests. Which steps should a solutions architect take to block requests from unauthorized users? (Choose two.)

To block unauthorized users and botnet requests, a solutions architect should implement an AWS WAF rule. AWS WAF (Web Application Firewall) allows you to define rules based on IP addresses, HTTP headers, HTTP body, or URI strings to filter out malicious traffic before it reaches your API Gateway or Lambda function. This effectively targets and blocks botnet requests. Additionally, creating a usage plan with an API key shared only with genuine users provides an authentication layer. Only requests presenting a valid API key will be processed, effectively blocking