A retail company runs a fleet of internet-facing Azure VMs that host administrative and legacy management services. The security architect wants to reduce the exposed attack surface for RDP and SSH management ports while allowing occasional, audited administrator access. Separately, the architect needs a recommendation engine that continuously analyzes actual traffic flows to propose tighter Network Security Group (NSG) rules that lock down other application ports to only the source IP ranges observed communicating with the VMs. Which Microsoft Defender for Cloud capabilities should the architect specify to meet BOTH requirements respectively?