An architect must distinguish database encryption at rest from controlling which users may query sensitive rows. Which statement is accurate?

1. TDE prevents every authorized SQL user from reading decrypted results
2. Private IP addressing removes the need for database authorization
3. A database backup schedule automatically defines row permissions
4. At-rest encryption and query authorization require separate controls