You run a critical OLTP workload on a single Azure SQL Database (Business Critical). You need automatic cross-region failover with minimal connection string changes and want reporting queries to run against the secondary by default. Which two configurations should you implement?

An auto-failover group provides automatic failover for a group of databases, including cross-region failover, and uses a single listener endpoint that remains unchanged, minimizing connection string modifications. This directly addresses the requirement for minimal connection string changes and automatic cross-region failover. The read-only listener endpoint of the failover group allows reporting queries to be directed to the secondary replica by default, offloading the primary and meeting the reporting requirement. Configuring active geo-replication only would require manual connection string changes during a failover, which doesn't meet the "minimal connection string changes" requirement. Enabling zone redundancy provides high availability within a region, not cross-region failover, and directing reporting to a read scale-out replica on the primary doesn't utilize a cross-region secondary for reporting. Azure Front Door is an application delivery network and web application firewall, not a solution for routing TDS traffic directly for SQL database failover.