You are implementing a Google Cloud Armor security policy to protect your web application's backend from common attacks like cross-site scripting (XSS) and SQL injection (SQLi). What are two prerequisites for using Google Cloud Armor security policies? (Choose two.)