In a single cluster VM encryption scenario, which two VMs should be excluded from encryption? (Choose two.)