A streaming media company is using an Application Load Balancer (ALB) to manage the traffic of its on-demand video service. Recently, they deployed Amazon CloudFront to accelerate content delivery. Despite this, the company noticed that some requests are still bypassing CloudFront and reaching the ALB directly. The company needs to ensure that its Amazon EC2 instances, which are behind the ALB, only process traffic coming from CloudFront. Which combination of steps should the company undertake to fulfill these requirements? (Select TWO.)