Security requires proof that a workload has no unintended internet access path after an infrastructure update. Which approach best combines prevention and verification?

1. Use a private-looking hostname for the internet-facing endpoint.
2. Apply controlled egress routes and policies, then analyze the defined prohibited internet-access scope.
3. Check only the instance uptime metric after deployment.
4. Remove the public DNS record and assume the instance has no internet path.