Users report they are being unexpectedly logged out of a stateful web app earlier than its 15-minute timeout. The app runs on EC2 instances in an Auto Scaling group behind an Application Load Balancer (one target group). The ALB is the origin for a CloudFront distribution. Sticky sessions are enabled on the ALB using duration-based cookies, and the app also issues its own session cookie. Which combination of changes should the SysOps administrator implement to stop the premature logouts? (Choose two.)

The premature logouts are likely due to the ALB not consistently routing user requests to the same EC2 instance, or CloudFront caching responses that should be dynamic. Enabling cookie forwarding in CloudFront ensures that the application's session cookie is passed to the origin (ALB/EC2), allowing the application to maintain the user's session state correctly. Switching the ALB to use application-controlled cookies for session affinity (also known as application-based stickiness) means the ALB will respect the session cookie issued by the web application itself. This ensures that all requests from a user with a specific session cookie are consistently routed to the same EC2 instance where that session was established, preventing premature logouts caused by requests being sent to different instances. Changing to the least outstanding requests algorithm is a load balancing algorithm and does not address session stickiness. Setting the duration-based ALB cookie name to AWSALB is the default and doesn't solve the issue if the application uses its own session cookie. Configuring the ALB to use the expiration cookie header is not a standard or recommended method for ensuring session stickiness in this scenario.