What are two alternatives to implement the integration and protect against malicious calls to Heroku app’s endpoint?

Universal Containers needs to integrate with a Heroku service that resizes product images submitted by users.

What are two alternatives to implement the integration and protect against malicious calls to Heroku app’s endpoint? Choose 2 answers
A . Create a trigger that uses an @future Apex HTTP callout passing JSON serialized data and some form of pre-shared secret key. so that the Heroku app can authenticate requests and store the resized images in Salesforce.
B . Create a trigger that uses an @future Apex HTTP callout passing JSON serialized data; therefore the Heroku app can automatically reply back to the callout with the resized images in Salesforce.
C . Create a Workflow Rule with an Outbound Message and select Send Session ID so that the Heroku app can use it to send the resized images back to Salesforce.
D . Create a Workflow Rule with an Outbound Message allowing the Heroku app to
automatically store the resized images in Salesforce.

View Answer

Answer: C,D