A globally served website hosted on EC2 behind an Application Load Balancer (ALB) is configured as the origin for a CloudFront distribution to reduce load on web servers. After a week there is no reduction in server load and requests still appear to be hitting the ALB directly. Which issues could explain this behavior? (Choose two.)

The DNS records must point to the CloudFront distribution's domain name for traffic to flow through CloudFront. If DNS still resolves to the ALB, users will bypass CloudFront entirely, explaining why server load hasn't decreased. Setting CloudFront's TTL values to 0 seconds means content is not cached at the edge. Every request will be forwarded to the origin (ALB), effectively eliminating the caching benefit and increasing origin load. An Origin Access Identity (OAI) is for S3 origins, not ALBs. While an ALB security group could block CloudFront, the problem states requests are hitting the ALB directly, implying no blocking. Sticky sessions on the ALB wouldn't prevent CloudFront from reducing origin load; they manage session persistence after traffic reaches the ALB.