An S3 bucket has correctly scoped access permissions and default encryption at rest. An audit requires rejecting object requests that are sent without TLS. Which control directly enforces this requirement?

1. Enable S3 Versioning and retain noncurrent versions for 30 days.
2. Allow requests when the client uses Signature Version 4, but do not check the transport protocol.
3. Add a bucket-policy explicit Deny for requests when aws:SecureTransport is false.
4. Enable SSE-S3 default encryption on the bucket.