You deploy Azure Front Door (Standard/Premium) in front of two multi-region web workloads: /api and /web. Requirements: route /api/* to Origin Group A and /web/* to Origin Group B; each origin exposes a health endpoint at /healthz returning HTTP 200; apply a WAF policy with a custom rule that blocks specific user-agents only for requests to /api. Which two configurations should you implement? Choose two.

Creating two routes, one for /api/ to Origin Group A and another for /web/ to Origin Group B, directly addresses the requirement to route traffic based on URL paths to specific origin groups. Associating the WAF policy with the custom block rule specifically to the /api route ensures the user-agent blocking is applied only where needed, fulfilling that requirement. Setting the health probe path to /healthz and requiring HTTP 200 accurately reflects the origins' health endpoint, ensuring Azure Front Door correctly monitors their availability. Configuring a single origin group with weighted load balancing would not separate traffic for /api and /web. Using the default health probe path “/” would likely fail, as the origins expose /healthz. Attaching the WAF policy at the Front Door endpoint and relying on global exclusions for /web is less efficient and more complex than applying the policy directly to the /api route.