Users connect to Azure from home via point-to-site VPN and from customer sites via site-to-site VPNs. App1 runs on multiple Windows Server 2016 VMs. Which two Azure services can distribute incoming connections across all the VMs? (Choose two.)

An internal load balancer distributes traffic to resources within a virtual network or to resources accessible via VPN, making it suitable for both point-to-site and site-to-site VPN connections. An Azure Application Gateway is a web traffic load balancer that can distribute HTTP/HTTPS traffic to backend servers, including VMs, and offers advanced features like WAF and SSL offloading. A public load balancer is incorrect because it distributes traffic from the internet to public-facing resources, not internal or VPN-connected ones. Azure CDN is for caching content closer to users, not for load balancing application traffic. Traffic Manager is a DNS-based traffic router for global distribution, not a local load balancer for VMs within a virtual network.