A web application is served from EC2 instances behind an internet-facing ALB. You must place Amazon CloudFront in front of the ALB and ensure client data coming from outside the VPC is encrypted in transit. Which two CloudFront settings should you use? (Choose two.)

To ensure client data is encrypted in transit from outside the VPC, two CloudFront settings are crucial. First, setting the Viewer Protocol Policy to "Redirect HTTP to HTTPS" forces all incoming viewer requests to use HTTPS, encrypting data between the client and CloudFront. Second, setting the Origin Protocol Policy to "Match Viewer" ensures that CloudFront uses the same protocol (HTTPS in this case) to communicate with your ALB origin as the viewer used to communicate with CloudFront. This maintains encryption end-to-end. Restricting viewer access with signed URLs is for authorization, not encryption. Field-level encryption encrypts specific data fields, not the entire transit. Automatic object compression optimizes delivery, but doesn't enforce encryption.