Refer to the exhibit. Which two steps mitigate attacks on the webserver from the Internet? (Choose two.)

Creating a firewall ACL that permits only TLS 1.3 ensures all inbound connections use the most current and secure protocol version, which eliminates known vulnerabilities associated with older versions such as TLS 1.0 and 1.1 (for example, POODLE and BEAST attacks) and enforces strong cipher suites by design.

A reverse proxy deployed in the DMZ acts as an intermediary between Internet clients and the backend webserver, concealing the server's internal address, terminating connections, and providing an additional inspection point where malicious requests can be identified and blocked before they reach the webserver.

Allowing only external connections is not a coherent security policy and would block legitimate internal administrative traffic while providing no meaningful filtering of threats from the Internet.

Moving the webserver to the internal network makes it unreachable from the Internet, which prevents it from serving its intended purpose as a public-facing web resource.

Placing the webserver directly on the external network removes all firewall protection, fully exposing it to untrusted Internet traffic with no filtering or inspection layer.