A team masks a sensitive column in query output and assumes this alone is a complete security boundary against all database users. What should be explained?

1. Masking grants all users permission to update the column
2. Masking replaces all network restrictions
3. Dynamic masking must be combined with appropriate permissions and other controls
4. Masking automatically removes the original stored values