You are deploying an internal microservice using Cloud Run. The service should only be accessible by other resources within your VPC network and should not be reachable from the public internet. Which TWO configurations must you apply to secure the Cloud Run service? (Select TWO)

Securing a fully managed Cloud Run service requires configuring both network and identity controls. Setting Ingress to 'Internal' blocks all traffic originating from the public internet. Removing `allUsers` from the `Cloud Run Invoker` IAM role ensures that even if a request originates from within the VPC, the caller must present a valid Google-signed identity token to execute the service.