What two tests should the architect verify?

The architect at Universal Containers is trying to ensure that security vulnerabilities are not present within the Salesforce organization.

What two tests should the architect verify? Choose 2 answers
A . Test Cross-Site Scripting on Apex queries.
B. Test Cross-Site Scripting on custom pages.
C. Test for SOQL Injection.
D. Test for invalid user access attempts.

Answer: B,C