An engineer is creating a policy for VPN1 users. Their scavenger traffic at site 101 must pass through a firewall. Which two match conditions must be selected to enable this policy? (Choose two.)

'protocol' alone identifies IP protocol numbers (TCP/UDP) but cannot distinguish scavenger traffic from other traffic sharing the same protocol, making it insufficient for this use case.

The 'application/application family list' match condition identifies scavenger traffic by its application classification (DSCP CS1 or low-priority application family), which is the standard way to classify scavenger-class flows in SD-WAN data policy.

The 'source data prefix' match condition scopes the policy to traffic originating from site 101 users' subnet, ensuring only VPN 1 users at that site are subject to the firewall steering policy.

'packet length' is unrelated to QoS traffic classification and does not identify scavenger-class flows.

'destination port' identifies specific application ports but scavenger class spans many applications and ports, making a single port match inadequate to capture the full scavenger traffic category.