A security team has CloudTrail management events but cannot investigate which principal downloaded a particular sensitive S3 object last week. What collection change addresses the missing evidence for future investigations?

1. Enable S3 Inventory as the sole historical access audit source.
2. Enable appropriately scoped S3 object-level data events.
3. Increase retention of management events without enabling data events.
4. Enable only VPC Flow Logs and use source IP as conclusive IAM attribution.