A development team is creating a new web application in the AWS Cloud. The primary domain, example.com, is hosted in an Amazon Route 53 public hosted zone within one of the company's production AWS accounts.

The developers need to test the web application in the staging AWS account using publicly resolvable subdomains under example.com, with the ability to create and delete DNS records as required. They have full access to Route 53 hosted zones in the staging account but are restricted from accessing resources in any production AWS accounts.

What two steps should a network engineer implement to enable the developers to create DNS records under the example.com domain? (Choose two.)