A workload must accept inbound HTTPS only from a corporate network. Which security group rule is the most appropriate baseline?

1. Allow TCP 443 from the approved corporate source CIDRs only.
2. Allow every protocol from 0.0.0.0/0 because TLS provides network isolation.
3. Allow only outbound 443 and assume it authorizes new inbound client connections.
4. Allow TCP 443 from all sources and use the security group description as a restriction.