Which two configurations should you recommend?

Your company is developing an invoicing application that will use Azure Active Directory (Azure AD) B2C. The application will be deployed as an App Service web app. You need to recommend a solution to the application development team to secure the application from identity related attacks.

Which two configurations should you recommend? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
A . Azure AD Conditional Access integration with user flows and custom policies
B . Azure AD workbooks to monitor risk detections
C . custom resource owner password credentials (ROPC) flows in Azure AD B2C
D . access packages in Identity Governance
E . smart account lockout in Azure AD B2C

Answer: A, C

Explanation:

https://docs.microsoft.com/en-us/azure/active-directory-b2c/threat-management

https://docs.microsoft.com/en-us/azure/active-directory-b2c/conditional-access-user-flow?pivots=b2c-user-flow