Orion Foods serves dynamic pricing via CloudFront backed by an ALB. Competitors are scraping /prices aggressively, and security also wants browsers to enforce strict security headers without changing the origin. Which actions should the team take to meet both goals with minimal operations overhead? (Choose two.)

The correct options address both requirements with minimal operational overhead. A WAF rate-based rule on the CloudFront Web ACL, scoped to the /prices path and aggregating by IP, effectively mitigates aggressive scraping by blocking or throttling requests from individual IPs exceeding a defined rate. This is a CloudFront-level solution, protecting the origin. Attaching a CloudFront managed response headers policy to the cache behaviors allows you to inject security headers like HSTS, X-Content-Type-Options, X-Frame-Options, and a CSP without modifying the origin (ALB or EC2 instances). AWS Shield Standard is enabled by default and provides basic DDoS protection but does not automatically add response headers or granular rate limiting for specific paths. Adding headers via an ALB listener rule would require modifying the origin, which the question explicitly states should be avoided. Using security groups to throttle connections at the edge is not feasible; security groups operate at the instance/ENI level, not at the CloudFront edge, and do not offer IP-based rate limiting for specific paths.