A developer uses WebSocket APIs in Amazon API Gateway and wants to enforce access control via an API Gateway Lambda authorizer. The developer also wants credential caching to avoid sending secret keys or auth tokens on every request. Which combination of steps should be taken? (Choose two.)

A token-based Lambda authorizer is the correct choice for enforcing access control with credential caching because it allows the authorizer to receive and validate a token (like a JWT or custom token) that can be cached by API Gateway. This avoids re-sending secret keys or auth tokens on every request, improving performance and reducing overhead. Request-parameter-based authorizers, while useful for other scenarios, do not typically handle token-based authentication with caching in the same efficient manner. To pass information from the authorizer to the backend integration, you should configure the integration request mapping template to reference the authorizer context map. The authorizer can return a context map in its output, and these key-value pairs can then be accessed in the integration request via $context.authorizer.keyname. This allows the authorizer to inject validated user identity or authorization details into the backend request. Referencing the identity API key value is incorrect as API keys are for usage plans and throttling, not for passing authorizer-generated context. VPC endpoint policies are for network access control, not API Gateway authorization logic.