A design relies entirely on a private subnet and assumes applications inside it never require authentication. Which change best aligns with a defense-in-depth approach?

1. Add identity-based authorization, workload protection, monitoring, and network controls
2. Treat replication as a substitute for authorization
3. Remove identity controls because all addresses are private
4. Replace all application checks with a resource naming convention