A security engineer is building an AWS Lambda function that must use a role named LambdaAuditRole to assume a role named AcmeAuditFactoryRole in another AWS account. When the code runs, it fails with: “An error occurred (AccessDenied) when calling the AssumeRole operation.” Which combination of actions will resolve the error? (Choose two.)

To assume a role in another account, two conditions must be met. First, the calling role (LambdaAuditRole) must have an identity-based policy that explicitly grants sts:AssumeRole permission to the target role (AcmeAuditFactoryRole). This is why "Ensure LambdaAuditRole has sts:AssumeRole permission for AcmeAuditFactoryRole" is correct. Second, the target role (AcmeAuditFactoryRole) must have a resource-based trust policy that allows the calling role (LambdaAuditRole) to assume it. This is why "Update the AcmeAuditFactoryRole trust policy to allow sts:AssumeRole from LambdaAuditRole" is correct. "Attach the AWSLambdaBasicExecutionRole managed policy to LambdaAuditRole" is incorrect because this policy grants permissions for Lambda to write logs to CloudWatch, not to assume other roles. "Update the LambdaAuditRole trust policy to allow sts:AssumeRole from the lambda.amazonaws.com service" is incorrect because this trust policy allows the Lambda service to assume LambdaAuditRole, not for LambdaAuditRole to assume another role. "Ensure the sts:AssumeRole API call targets the us-east-1 Regional endpoint" is incorrect as sts:AssumeRole is a global API call and does not require targeting a specific regional endpoint.