Which two components of a Security policy, when configured, allow third-party contractors access to internal applications outside business hours? (Choose two.)