A planned routing change must not silently expose isolated development VPCs to production. Which validation approach best addresses this risk?

1. Check only that one production webpage returns HTTP 200.
2. Disable all logging to avoid false alarms during the change.
3. Analyze defined network access scopes and compare unintended-access findings before and after the change.
4. Verify that every VPC Name tag contains its environment.