An audit trail records S3 bucket configuration changes, but investigators cannot find a GetObject request for a sensitive object. The team must record future object reads for one sensitive prefix while limiting additional logging volume. Which change is required?

1. Enable only additional CloudTrail management events for the bucket.
2. Enable S3 Inventory and use the daily object list as a record of every GetObject call.
3. Enable S3 Versioning and use newly created version IDs to identify every read.
4. Configure CloudTrail S3 data-event selectors for read events on the required bucket prefix.