Which two are appropriate for mitigating this threat?

Your company is going through an extensive security audit and it has been identified that your
Internet-facing web site is vulnerable to SQL injection from authenticated users. Which two are
appropriate for mitigating this threat? (Choose two.)

A.
Using security roles in the deployment descriptor

B.
In stored procedures called with prepared statements

C.
Adding an Intercepting Validation filter to your system

D.
Requiring SSL in the deployment descriptor transport guarantee

Explanation: