A protected training job must not make arbitrary internet calls. Which configuration should be evaluated according to supported job requirements?

1. Allow all outbound destinations and rely only on a comment in the script.
2. Disable all data encryption to simplify private networking.
3. Put the job in a VPC and assume every outbound path is automatically denied.
4. Use supported network isolation and required private access paths for approved data and service dependencies.