When using an out-of-band API connection with your sanctioned cloud service, what are two capabilities available to the administrator? (Choose two.)