An internal website with sensitive content will be exposed publicly, but access must be restricted so only employees who authenticate via the company's OpenID Connect (OIDC) identity provider can reach it. The website cannot be modified. Which combination of steps will implement this requirement? (Choose two.)

An Application Load Balancer (ALB) is required because it operates at the application layer (Layer 7) and supports advanced routing features, including OIDC authentication. A Network Load Balancer (NLB) operates at Layer 4 and does not support OIDC authentication directly. Configuring a listener on HTTPS (port 443) is crucial for securing sensitive content with encryption, and the default authenticate action referencing the OIDC IdP ensures that only authenticated employees can access the website. Using HTTP (port 80) would expose sensitive content unencrypted. While AWS Lambda can be used for custom authentication, the question specifically asks for OIDC integration, which ALBs support natively with an authenticate-oidc action.