Which two steps should an app builder take to configure the proper security?

Universal Containers has created two custom objects called Seminars and Attendees. Organization-wide defaults for those objects have been set to private. Universal Containers wants to set up a new junction object between these objects. A select group of users should be able to edit records in the junction object.

Which two steps should an app builder take to configure the proper security?
A . Create an owner-based sharing rule that gives Read access to the junction object.
B . Set Sharing Settings to Read Only on both master-detail relationship fields.
C . Set lookup filters on both junction object relationship fields.
D . Create owner-based sharing rules that give Read access to the master objects.

Answer: C,D