Your Company Has Just Launched a New Critical Revenue-Generating Web

Your company has just launched a new critical revenue-generating web application. You deployed the application for scalability using managed instance groups, autoscaling, and a network load balancer as frontend. One day, you notice severe bursty traffic that caused autoscaling to reach the maximum number of instances, and users of your application cannot complete transactions. After an investigation, you think it is a DDOS attack. You want to quickly restore user access to your application and allow successful transactions while minimizing cost. Which two steps should you take? (Choose two.)

A) Use Cloud Armor to blacklist the attacker's IP addresses.
B) Increase the maximum autoscaling backend to accommodate the severe bursty traffic.
C) Create a global HTTP(s) load balancer and move your application backend to this load balancer.
D) Shut down the entire application in GCP for a few hours. The attack will stop when the application is offline.
E) SSH into the backend compute engine instances, and view the auth logs and syslogs to further understand the nature of the attack.